Security audit

Install OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly an installer/configuration helper, but it uses unsafe installation paths and handles credentials in ways users should review carefully before installing.

Review this skill before installing. Prefer the package-manager path over curl-to-bash, avoid running repair scripts blindly, and do not use the Claude relay unless you intentionally trust that endpoint with your API key and model traffic. If you configure secrets, restrict ~/.openclaw permissions yourself and avoid running the chmod -R 755 repair step until it is fixed.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:65
Finding: Mutable Remote Installer Is Piped Directly into Bash
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/install.sh:27
Finding: Unpinned Global Packages and Plugin Dependencies Execute Mutable Supply-Chain Code
Content: View full analysis
/dev/null; then npm install -g pnpm fi pnpm add -g openclaw ``` From `scripts/install-feishu.sh`: ```bash if command -v git &> /dev/null; then git clone https://github.com/openclaw/feishu-plugin.git "$PLUGINS_DIR/feishu" 2>/dev/null || \ echo "Unable to clone from GitHub; install it manually" fi if [ -d "$PLUGINS_DIR/feishu" ]; then cd "$PLUGINS_DIR/feishu" pnpm install fi ``` From `scripts/fix-bugs.sh`: ```bash for plugin_dir in "$PLUGINS_DIR"/*/; do if [ -d "$plugin_dir" ]; then plugin_name=$(basename "$plugin_dir") if [ -f "$plugin_dir/package.json" ]; then cd "$plugin_dir" && pnpm install --silent 2>/dev/null || \ echo "Dependency repair failed for plugin $plugin_name" fi fi done ``` ### Technical Analysis The installer retrieves the latest available `pnpm` and `openclaw` packages rather than exact reviewed versions. The Feishu plugin is cloned from the current repository head without a commit pin, signed-tag verification, or checksum validation. Both plugin installation and bug repair invoke `pnpm install`. Package managers can execute lifecycle hooks defined by the cloned plugin or any transitive dependency. The repair script does this for every plugin directory under `~/.openclaw/plugins`, including plugins unrelated to this Skill. The global package installations also affect the user's wider development environment rather than an isolated Skill-specific environment. ### Attack Path 1. An attacker compromises a package release, repository branch, maintainer account, or transitive dependency. 2. A malicious package ver ...[truncated 994 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fix-bugs.sh:43
Finding: Plaintext Credentials Are Exposed Through Insecure Recursive Permissions
Content: View full analysis
"$CONFIG_DIR/models.json" << EOF { "models": { "claude": { "provider": "openai-compatible", "baseUrl": "${API_URL}/v1", "apiKey": "${API_KEY}", "models": [ "claude-sonnet-4-5-20250929", "claude-opus-4-5-20250929", "claude-3-5-sonnet-20241022" ] }, "default": "claude-sonnet-4-5-20250929" } } EOF ``` From `scripts/install-feishu.sh`: ```bash cat > "$CONFIG_DIR/feishu.json" << EOF { "appId": "${APP_ID}", "appSecret": "${APP_SECRET}", "verificationToken": "${VERIFICATION_TOKEN}", "encryptKey": "${ENCRYPT_KEY}", "enabled": true } EOF ``` From `scripts/fix-bugs.sh`: ```bash chmod -R 755 ~/.openclaw 2>/dev/null || true ``` The scripts also create timestamped plaintext backups: ```bash cp "$CONFIG_DIR/models.json" "$CONFIG_DIR/models.json.bak.$(date +%Y%m%d%H%M%S)" cp "$CONFIG_DIR/feishu.json" "$CONFIG_DIR/feishu.json.bak.$(date +%Y%m%d%H%M%S)" ``` ### Technical Analysis The scripts write bearer tokens, an App Secret, a verification token, and an encryption key directly into JSON files. They do not set a restrictive `umask` or explicitly apply mode `600` to the resulting files and backups. The repair script then recursively applies mode `755` to the entire `~/.openclaw` tree. For regular files, mode `755` grants read permission to group members and all other local users. It also adds executable permission unnecessarily. Consequently, credentials and backup copies can become readable by unrelated local accounts. The recursive operation also changes permissions for unrelated OpenClaw files and plugins, exceeding the minimum scope needed fo ...[truncated 1017 chars]
Remediation: View remediation

other

Warning

Location: scripts/configure-claude.sh:10
Finding: API Key and Model Traffic Are Routed to a Hard-Coded Third-Party Relay
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:260
Finding: Skill Instructs the Agent to Persist Skill-Controlled Values in Long-Term Memory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (25)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: Fetching a remote script and executing it as part of the installation flow creates a classic supply-chain risk. If the remote host, transport, or script content is compromised, the system will run attacker-controlled code immediately.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
bash
# 使用官方安装脚本 curl -fsSL https://openclaw.ai/install.sh | bash # 或使用 pnpm 安装 pnpm add -g openclaw

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The | bash construct removes the inspection step and directly chains downloaded content into execution. In this skill context, that makes the installation path especially dangerous because it encourages immediate execution of network-provided code on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
bash
# 使用官方安装脚本 curl -fsSL https://openclaw.ai/install.sh | bash # 或使用 pnpm 安装 pnpm add -g openclaw

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/install-feishu.sh (reported line 66)May include surrounding context.
sh
read -p "是否重新安装？(y/N) " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then rm -rf "$PLUGINS_DIR/feishu" else echo "✅ 跳过安装" fi

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README instructs users to configure sensitive credentials such as an API key, App ID, App Secret, and Verification Token, but provides no guidance on secure entry, storage, masking, or avoiding accidental disclosure. In an installation skill that automates setup, this omission increases the chance that secrets will be placed in shell history, plaintext files, logs, or screenshots, leading to credential compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README advertises bug-fix, cleanup, reset, and restart actions such as clearing logs, resetting configuration, and restarting the gateway without warning that these operations can modify state, remove data, or interrupt service. In an automation/install skill, users may run these commands expecting them to be safe diagnostics, which can cause accidental disruption or loss of configuration.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly instructs shell execution and system modification, but it declares no tool scope or allowed-tools restrictions. This increases the risk that an agent may execute powerful commands without an explicit capability boundary or user-awareness guardrail.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The entire skill description and operational guidance are written in Chinese, with no indication that language choice is optional or limited to a justified region-specific deployment. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill recommends remote install and automation scripts, including piping a downloaded script directly to bash, without an explicit warning that they will modify the host. This is dangerous because it normalizes high-risk execution of unreviewed code with immediate system impact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill collects and stores API keys and Feishu secrets in configuration files but provides no security guidance for handling, redaction, storage permissions, or log hygiene. This increases the chance of accidental credential exposure through shell history, shared files, or agent memory.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill hard-codes a specific third-party relay endpoint for Claude traffic that is not required for generic OpenClaw installation. This can steer user traffic and secrets to an external service, creating supply-chain, privacy, and credential-exposure risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill includes cleanup and reset-style operations such as log cleaning and gateway cleaning without warning that data, logs, or state may be removed. Users or agents could perform destructive maintenance steps without understanding the operational consequences.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Sending an outbound Feishu test message goes beyond installation/configuration and triggers a real external action. In a skill context, that can cause unintended data disclosure, spam, or misuse of configured messaging credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The troubleshooting section includes a configuration reset command that can erase or overwrite service setup without an explicit destructive-action warning. In an automated skill, this can lead to loss of working configuration and interruption of service.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction to write service details into MEMORY.md encourages persistence of configuration-related information beyond the immediate task. Even though the listed items are partly non-secret, this pattern normalizes storing operational details and could easily expand to sensitive endpoints, tokens, or environment data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script writes the user-supplied API key in plaintext to ~/.openclaw/config/models.json, creating a persistent local secret without any warning, permission hardening, or use of a secure secret store. If the file is later exposed through weak filesystem permissions, backups, logs, sync tools, or malware on the host, the key can be stolen and abused to access the third-party API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script automatically extracts the stored API key from the local configuration and sends it in an Authorization header to the configured remote base URL during a connectivity test, without explicit prior consent or warning. In an installation/repair skill that may manage third-party relay endpoints, this is risky because a misconfigured or malicious baseUrl can silently receive valid credentials, causing credential exposure or unintended external communication.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script collects App Secret, Verification Token, and optionally Encrypt Key, then writes them directly into ~/.openclaw/config/feishu.json in plaintext without setting restrictive file permissions or warning the user. Any local user, backup system, support bundle, or malware with access to the home directory may recover these credentials and use them to impersonate or compromise the Feishu integration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: If pnpm is missing, the script automatically runs npm install -g pnpm, which performs a global package installation and changes the user's environment. The message says pnpm was not found and is being installed, but it does not clearly warn about the global system modification or ask for consent before doing so.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script performs a global install with pnpm add -g openclaw, which writes to system/user package locations and changes the runtime environment. Although the script prints progress messages, it does not explicitly warn the user beforehand that it will install software globally or alter their environment, and there is no confirmation prompt for this first-time install path.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/install.sh (reported line 59)May include surrounding context.
sh
# 初始化配置 echo "⚙️ 初始化配置..." if [ ! -d ~/.openclaw ]; then mkdir -p ~/.openclaw fi # 创建必要的目录

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill name and description are entirely in Chinese, with no indication that other languages are supported or that the user can opt into this locale. Under the policy for natural-language violations, this is a locale/language constraint that is not documented as optional or justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script’s prompts and status messages are entirely in Chinese, which imposes a specific language on all users without offering an alternative or opt-in. The policy requires flagging language or locale constraints unless the skill offers a choice or clearly documents a justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's comments, prompts, and status messages are entirely in Chinese, including the interactive confirmation prompt. There is no indication that the skill is region-specific or that users can opt into another language, which creates a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: All comments and interactive prompts are presented in Chinese, including installation instructions and confirmations. There is no indication that the skill is intended only for a Chinese-speaking or region-specific audience, and no user opt-in or language selection is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: All prompts, status messages, and usage instructions in the script are presented only in Chinese. This forces a specific language on users without offering a language choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.