Security audit

permission guard

Security checks for vulnerabilities and agentic risk

Overview

This watchdog skill has a legitimate security-monitoring purpose, but it asks for broad local inspection and persistent logging that could expose sensitive local activity metadata.

Install only if you are comfortable with a local watchdog that may inspect broad home-directory path metadata, active network connections, and retain audit logs under ~/.openclaw. Prefer running it only on explicit request, review or delete its logs and baselines periodically, and avoid letting it record commands or URLs containing secrets.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:30
Finding: Overbroad Home-Directory Enumeration for Sensitive File Monitoring
Content: View full analysis
/dev/null \ | grep -E '(\.ssh|\.aws|\.gnupg|\.config/gcloud|\.gitconfig|/etc/passwd|/etc/shadow|Library/Keychains|\.config/google-chrome|\.mozilla)' \ | head -30 # Update timestamp after check: touch ~/.openclaw/last-check ``` ### Technical Analysis The command recursively enumerates all recently modified files under the user's home directory before filtering the results for credential, browser, and configuration paths. Although the Skill's security-monitoring purpose justifies checking for suspicious access, recursively traversing the entire home directory exceeds the minimum scope necessary and exposes unrelated filenames and directory structure to the Agent. The check also relies on filesystem modification times. A modification timestamp can indicate that a file changed, but it cannot establish that another Skill read the file or identify which process caused the change. Consequently, the implementation may misattribute ordinary user or application activity to an installed Skill. The pre-scan reference to SSH key access is not evidence that private-key contents are read or written. The command only enumerates file metadata and matching paths. Nevertheless, those paths are sensitive metadata and may subsequently appear in Agent context, logs, or reports. ### Attack Path 1. A user invokes the permission report or the Skill triggers a post-installation baseline check. 2. The Agent executes `find ~`, recursively enumerating recently modified files throughout the user's home directory. 3. The pipeline selects paths associated with SSH, AWS, GnuPG, cloud, browser, and other sensitive configuration. 4. Up to 30 matching paths enter the Agent's context and may be included in a report. 5. Unrelated changes may be attribute ...[truncated 472 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:44
Finding: System-Wide Network and Process Metadata Inspection
Content: View full analysis
/dev/null | grep -Ev '(127\.0\.0\.1|::1|LISTEN)' ``` ### Technical Analysis The command requests all visible non-loopback TCP connections and associated process information. It is not scoped to OpenClaw, the Agent process, or a particular monitored Skill. As a result, connections created by browsers, messaging clients, system services, and unrelated applications may enter the Agent's context. The data is insufficient for reliable Skill attribution. A point-in-time system-wide connection listing does not demonstrate that a particular Skill initiated a connection, nor does it establish what data was transmitted. Suppressing errors with `2>/dev/null` can also hide permission or platform limitations that reduce the reliability of the result. ### Attack Path 1. A user requests an activity or permission report. 2. The Agent executes `ss -tnp`. 3. The command collects all visible active TCP endpoints and associated process metadata. 4. The loopback and listening entries are removed, but unrelated external connections remain. 5. Those endpoints may be reported as suspicious or incorrectly associated with a monitored Skill. ### Impact Assessment This exposes remote endpoints and process metadata belonging to unrelated applications. Depending on the environment, endpoint information can reveal services, organizations, browsing activity, or other operational context. The command does not obtain elevated privileges by itself, but its system-wide scope exceeds what is necessary to monitor a specific Skill and can produce misleading security conclusions. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:14
Finding: Persistent Plaintext Logging of Potentially Sensitive Commands, Paths, and URLs
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: The scan pattern includes macOS Keychain and other credential stores, which are highly sensitive locations unrelated to many ordinary user tasks. In a defensive tool this may be well-intentioned, but the context still makes the capability dangerous because it grants the skill a rationale to inspect credential repositories broadly.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
bash
find ~ -newer ~/.openclaw/last-check -type f 2>/dev/null \ | grep -E '(\.ssh|\.aws|\.gnupg|\.config/gcloud|\.gitconfig|/etc/passwd|/etc/shadow|Library/Keychains|\.config/google-chrome|\.mozilla)' \ | head -30 # Update timestamp after check: touch ~/.openclaw/last-check

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The scan pattern includes macOS Keychain and other credential stores, which are highly sensitive locations unrelated to many ordinary user tasks. In a defensive tool this may be well-intentioned, but the context still makes the capability dangerous because it grants the skill a rationale to inspect credential repositories broadly.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
bash
find ~ -newer ~/.openclaw/last-check -type f 2>/dev/null \ | grep -E '(\.ssh|\.aws|\.gnupg|\.config/gcloud|\.gitconfig|/etc/passwd|/etc/shadow|Library/Keychains|\.config/google-chrome|\.mozilla)' \ | head -30 # Update timestamp after check: touch ~/.openclaw/last-check

Credential Access

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: The scan pattern includes macOS Keychain and other credential stores, which are highly sensitive locations unrelated to many ordinary user tasks. In a defensive tool this may be well-intentioned, but the context still makes the capability dangerous because it grants the skill a rationale to inspect credential repositories broadly.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
bash
find ~ -newer ~/.openclaw/last-check -type f 2>/dev/null \ | grep -E '(\.ssh|\.aws|\.gnupg|\.config/gcloud|\.gitconfig|/etc/passwd|/etc/shadow|Library/Keychains|\.config/google-chrome|\.mozilla)' \ | head -30 # Update timestamp after check: touch ~/.openclaw/last-check

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
touch ~/.openclaw/last-check

text
Flag any match. The risk is concrete: a rogue skill reading `~/.ssh/id_rsa` while appearing to do something routine is a classic credential exfiltration path. ### Check 2 — Outbound Network Connections

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs proactive triggering after any skill installation and for broad, routine-sounding situations. That can cause the watchdog to run without a narrowly scoped user request, increasing unnecessary access to local state and broadening its operational footprint beyond least-privilege expectations.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill requests Write capability in addition to Bash and Read, which enables persistent modification of local state such as logs, baselines, and timestamps. For a monitoring skill, persistence may be functional, but it increases the blast radius by allowing durable artifacts and state changes that survive the session and could be repurposed for stealth or tracking.
Content: Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.
md
name: permission-guard description: Security watchdog for OpenClaw agents that monitors installed skill behavior, detects unauthorized file access, suspicious outbound network calls, dangerous command patterns, and generates permission audit reports. Use this skill whenever the user asks about agent activity ("what did my agent do", "check what my skill accessed", "monitor agent permissions", "permission report", "activity log", "did my agent do anything weird", "skill behavior audit", "what files did my agent touch"), after installing a new skill to establish a behavior baseline, or when suspicious or unexpected behavior is suspected. Trigger proactively after any skill installation — a first-run baseline check is always worthwhile. compatibility: Designed for OpenClaw agents (openclaw.ai). Requires shell access for filesystem and network inspection. allowed-tools: Bash Read Write --- # Permission Guard

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs persistent logging of agent actions to a local file, including skill names, targets, and command/network metadata, but does not require a clear user-facing privacy notice or consent flow. Even if not exfiltrated, this creates a sensitive audit trail on disk that could expose user behavior, file paths, or internal commands to other local processes or future compromise.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 91% confidence
Finding: The first-run baseline logic creates persistent files under ~/.openclaw/baselines and updates a last-check timestamp, establishing durable per-skill state. While useful for monitoring, this persistence can reveal installed skills and sensitive environment structure over time, and it occurs proactively rather than only after explicit user approval.
Content: Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.
After any new skill is installed, capture a baseline before the skill runs for the first time. This makes future behavioral drift detection much more precise.

bash
mkdir -p ~/.openclaw/baselines stat ~/.ssh ~/.aws ~/.gnupg ~/.gitconfig 2>/dev/null \ > ~/.openclaw/baselines/[skill-name]-baseline.txt touch ~/.openclaw/last-check

Static analysis

No suspicious patterns detected.