Openclaw Onboarding

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:29 AM UTC
• Version: 1.0.0

Overview

This onboarding skill is mostly transparent about its goals, but it teaches broad persistent memory, private chat summarization, and unattended skill installation without enough safeguards.

Review carefully before installing. Do not store secrets, regulated personal data, or confidential company information in the memory feature. Only summarize chats you are authorized to process, and avoid unattended or global installation of additional skills unless the source, version, and permissions have been reviewed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/find-skills/SKILL.md:57
• Finding: Unpinned and Unattended Installation of Third-Party Skills<![CDATA[ ## Vulnerability Details **File Location**: `references/find-skills/SKILL.md:17-22,57-62`; `references/training/quickstart.md:279-284` **Vulnerability Type**: Supply-chain exposure through unsafe third-party installation **Risk Level**: Medium ### Evidence ```bash npx skills find [query] npx skills add <package> npx skills check npx skills update ``` ```bash npx skills add <owner/repo@skill> -g -y ``` ```bash clawhub install browser-use --yes ``` ### Technical Analysis The Skill instructs the agent to discover and install packages from GitHub or other external sources without requiring an approved-source policy, integrity verification, immutable version or commit pinning, or a security review of the retrieved package. The `-g` option expands the installation scope to the user-level global environment, while `-y` and `--yes` suppress confirmation. Consequently, a search result can transition directly into an unattended installation. Package names such as `browser-use` are mutable identifiers rather than cryptographically verified artifacts. This creates a dependency supply-chain risk. A malicious publisher, compromised repository, dependency-confusion package, typosquatted package, or compromised upstream release could supply instructions or executable components that were not present during this audit. ### Attack Path 1. An attacker publishes a malicious Skill matching a likely search query, compromises an existing Skill repository, or gains control of a mutable upstream release. 2. A user asks the agent to locate a Skill for a particular capability. 3. The agent runs the documented search workflow and presents the attacker-controlled package as a candidate. 4. The user accepts the recommendation, or the workflow proceeds using the documented unattended installation flags. 5. The agent runs `npx skills add <owner/repo@skill> -g -y` or `clawhub install browser-use --yes`. 6. The unreviewed package is installed into the agent environment and ca ...[truncated 795 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic installation and confirmation-bypass flags from the default workflow. 2. Require explicit, informed user approval immediately before every installation. 3. Restrict installations to an allowlist of trusted publishers and repositories. 4. Pin each dependency to an immutable, verified commit hash or signed release rather than a mutable package name. 5. Verify checksums, signatures, provenance attestations, and repository ownership before installation. 6. Review the complete Skill package, including manifests, scripts, hooks, nested dependencies, and requested permissions. 7. Prefer project-local installation over global installation to reduce the affected scope. 8. Run newly installed Skills in a sandbox with minimal filesystem, network, credential, and tool permissions. 9. Display the exact source, resolved version, requested permissions, and integrity information to the user before approval. 10. Maintain a lockfile or equivalent inventory so that subsequent installations reproduce the reviewed artifact. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: references/training/quickstart.md:71
• Finding: Destructive Overwrite of Persistent User Profile and Memory<![CDATA[ ## Vulnerability Details **File Location**: `references/training/quickstart.md:71-85,177-189` **Vulnerability Type**: Unsafe persistent-state file handling **Risk Level**: Low ### Evidence The onboarding workflow opens the profile file with a truncating shell redirection: ```bash cat > ~/.openclaw/user.md << 'EOF' ``` It later applies the same truncating operation to the persistent memory file: ```bash cat > ~/.openclaw/MEMORY.md << 'EOF' ``` ### Technical Analysis The shell `>` operator creates the target file if it does not exist and truncates it to zero length if it already exists. The workflow performs no existence check, backup, merge, locking, ownership validation, or overwrite confirmation before modifying persistent profile and memory files. As a result, running onboarding on an existing installation can silently destroy previously stored preferences and memory. The profile template also writes fixed example values instead of demonstrating validated substitution of the current user's answers, which can replace accurate state with example data. The quoted heredoc delimiter also prevents shell expansion inside the heredoc. Therefore, the documented `$(date +%Y-%m-%d)` value would be written literally rather than recording the intended date. This is primarily a state-integrity and reliability weakness rather than evidence of deliberate memory poisoning. ### Attack Path 1. A user already has profile or memory data in `~/.openclaw/user.md` or `~/.openclaw/MEMORY.md`. 2. The user starts or repeats the onboarding workflow. 3. The agent executes the documented `cat >` command. 4. The shell truncates the existing file before writing the template. 5. Previous persistent state is lost and replaced with fixed onboarding content. 6. Later sessions consume incomplete or inaccurate profile and memory information. An additional local risk exists if an attacker who already has access to the user's home directory can replace a target with a symbolic ...[truncated 841 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Check whether each target exists and request explicit confirmation before replacing it. 2. Create a timestamped backup with restrictive permissions before modifying persistent state. 3. Parse and merge existing structured data rather than replacing the entire file. 4. Write to a securely created temporary file in the same directory, validate the result, and atomically rename it into place. 5. Reject symbolic links and verify the target is a regular file owned by the expected user. 6. Set restrictive permissions, such as user read/write only, because profile and memory files may contain sensitive information. 7. Use an application-level serialization mechanism instead of shell heredocs for user-provided data. 8. Validate and safely encode all user-supplied fields before storage. 9. Replace fixed example identity values with the actual validated onboarding responses. 10. Generate timestamps in the application or use an unquoted expansion only if every expanded value is tightly controlled. 11. Add regression tests covering existing files, concurrent writes, interrupted writes, malformed data, and symbolic-link targets. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (34)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: Using a generic phrase like “记住” as an automatic persistence trigger creates a high risk of accidental storage of sensitive information from normal conversation. Because the documented behavior is to permanently write content to disk, users may disclose secrets, personal data, or regulated information without realizing it will be retained.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The group-chat summary feature is presented as if the assistant can access and analyze private chat content merely from a group name and time range, without warning about authorization, consent, or privacy implications. This can normalize unauthorized access patterns and encourage disclosure of private communications to the agent or connected tooling.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The entire onboarding guide and all example invocations are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can violate a language/locale policy when a specific language is imposed without user opt-in.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly instructs users to use a permanent memory feature ("让虾永久记住重要信息") without any warning about retention, sensitivity, or how stored data will be used. This can lead users to disclose personal, confidential, or business-sensitive information under the false assumption that it is transient or low risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README promotes summarizing group chats "不需要拉虾进群" without disclosing privacy, consent, or access-boundary implications. This encourages users to request analysis of potentially private conversations and may normalize processing data from chats whose participants did not expect an AI system to access or summarize them.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README advertises automatic skill discovery and installation as a simple command flow, but does not warn users that this may add and execute new capabilities from external sources. Installing skills dynamically expands the agent's privileges and behavior, increasing the risk of unreviewed code, malicious skills, or unsafe tool access being introduced.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill advertises '永久保存' memory behavior as a convenience feature without warning users that stored information may persist indefinitely and could include sensitive personal or workplace data. This creates a real privacy and data-retention risk because users may disclose information without understanding the durability or scope of storage.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill promotes summarizing group chats 'without needing to add [the agent] to the group' but provides no explanation of data access boundaries, authorization expectations, or privacy implications. Users may infer that analyzing third-party conversations is normal and safe even when the content may include confidential or non-consensual data.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases include very broad, everyday requests such as '怎么使用' and '不会用', which can cause the skill to activate unintentionally during unrelated conversations. This increases the chance that users are funneled into behaviors like memory storage or skill installation without clear intent or informed consent.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger guidance is broad enough to activate on common requests like 'how do I do X' or 'can you do X', causing the agent to steer ordinary help-seeking into skill discovery and possible installation workflows. In this skill, broad triggering materially increases exposure to external package search and install behavior, including the unpinned commands described elsewhere.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill repeatedly instructs the agent or user to run `npx skills` without pinning an exact package version, which allows whatever version is current in the npm registry at execution time to be fetched and run. Because this skill is specifically about discovering and installing further capabilities, an upstream package compromise, typo-squatting, or malicious update could lead directly to arbitrary code execution and untrusted skill installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This reference normalizes use of an unpinned `npx skills` package manager command. Running an unpinned package through `npx` can execute newly published or compromised code, which is especially dangerous here because the command chain leads to discovering and installing more code from external sources.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The command `npx skills add <package>` is presented without pinning the CLI version, so the bootstrap tool itself is mutable and fetched at runtime. In a skill whose purpose is package discovery and installation, this expands the trust boundary twice: first to the CLI package, then to the arbitrary package being installed.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: Even for `check`, invoking `npx skills` unpinned causes network-fetched code to run before performing the requested action. While the user intent is only to check for updates, a compromised or changed package version could still execute arbitrary code during startup.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: `npx skills update` combines unpinned runtime code execution with an operation that updates installed skills, increasing the chance of silently pulling malicious content from multiple sources. The skill context makes this more dangerous because it encourages trust in an ecosystem workflow without any version lock or provenance guardrails.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill instructs execution of `npx skills find [query]` without pinning the package version, so even a search operation starts by running mutable remote code. Because this skill may trigger on broad user requests, it can cause frequent exposure to that untrusted bootstrap path.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: This example encourages `npx skills find react performance` using an unpinned package, exposing users to runtime package substitution or malicious updates. The context is risky because the search results are then used to guide installation decisions, so compromise of the search tool can influence both execution and recommendation outputs.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: This is another unpinned `npx skills find` example. Since the skill is designed to be used as a discovery assistant, repeated unpinned examples reinforce insecure operational behavior and increase the likelihood of executing unexpected package code in normal workflows.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The unpinned search example for changelog-related skills has the same core issue: arbitrary code may be downloaded and executed via `npx` at the moment of use. Because the skill is a package discovery workflow, compromise can also steer the user toward malicious skills or repos.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The install instruction `npx skills add <owner/repo@skill>` is especially dangerous because it combines an unpinned bootstrap executable with installation of externally sourced content. An attacker controlling the CLI package, the repo reference, or the returned suggestion path could achieve code execution or persistence through installed skills.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This example tells users to install a skill via unpinned `npx skills add`, relying on both mutable npm resolution and a third-party repository. The skill context makes it more dangerous because it presents the command as a ready-to-run recommendation, which can lead users or agents to execute it with minimal scrutiny.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill recommends a global installation command with `-g -y` but does not include a clear warning that this installs unreviewed external code system-wide and suppresses safety prompts. In context, this omission makes accidental or overly trusting execution more likely and reduces the friction that would otherwise help users notice risk.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: `npx skills add <owner/repo@skill> -g -y` is particularly risky because it uses an unpinned bootstrap package, installs globally, and suppresses confirmation prompts. This creates a low-friction path to persistent system-wide installation of unreviewed external code, magnifying the impact of package compromise or malicious recommendations.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: This reference suggests creating a new skill with `npx skills init` without pinning the CLI version, so even initialization executes mutable remote code. Although lower impact than install/update paths, it still expands risk unnecessarily and normalizes unsafe package bootstrap practices.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The example `npx skills init my-xyz-skill` is another unpinned package execution path. While intended for scaffolding, a compromised package can still run arbitrary code locally and seed insecure project templates or postinstall behavior.

Static analysis

No suspicious patterns detected.