ClawHub
Back to skill

Security audit

OpenClaw Agent Skill

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a documentation skill, but it can present high-impact install and deployment commands that run remote scripts directly without integrity checks.

Install only if you want an OpenClaw documentation helper and will manually review privileged commands before running them. Be especially careful with installer, deployment, repair, daemon, and Tailscale/Node/Docker setup commands: download scripts first, verify publisher checksums or signatures when available, avoid running as root unless necessary, and back up OpenClaw credentials/configuration before repair or update flows.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
docs/02-installation.md:30
Finding
Unverified Remote Installation Scripts Are Executed Directly by Shell Interpreters## Vulnerability Details **File Location**: `docs/02-installation.md:30-46, 80-92, 113-125, 148, 186-195, 405, 898, 1269-1278`; operationalized by the verbatim reproduction requirements in `SKILL.md:25-29, 260-273` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```sh curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/install.sh | bash ``` ```sh curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/install.sh | bash -s -- --help ``` ```sh curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/install-cli.sh | bash ``` ```sh curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/install-cli.sh | bash -s -- --help ``` ```powershell iwr -useb https://openclaw.ai/install.ps1 | iex ``` ```sh curl -fsSL https://raw.githubusercontent.com/openclaw/openclaw-ansible/main/install.sh | bash ``` ```dockerfile RUN curl -fsSL https://bun.sh/install | bash ``` ```sh curl -fsSL https://openclaw.ai/install.sh | bash -s -- --install-method git --no-onboard ``` ### Technical Analysis These commands retrieve mutable content from external URLs and pass it directly to `bash`, `sh`, or PowerShell's `Invoke-Expression`. The downloaded payload is not saved for review and is not authenticated through an artifact signature, pinned commit, immutable release identifier, or expected checksum. HTTPS provides transport protection but does not guarantee that the remote publisher, hosting account, DNS configuration, distribution infrastructure, or future script revisions will remain trustworthy. If any relevant endpoint is compromised, the effective payload can change after this Skill package has been reviewed. The exposure is amplified by `SKILL.md`, which instructs the agent not to paraphrase documentation code and to reproduce exact commands. Consequently, a user asking for installation help may receive an immediately executable command ...[truncated 1377 chars]
Remediation
## Remediation Suggestions 1. Replace direct execution pipelines with a download, verification, inspection, and execution workflow. 2. Publish installation scripts as immutable, versioned release artifacts. 3. Publish SHA-256 checksums through an independently protected channel and verify them before execution. 4. Prefer cryptographic signatures with documented trusted signing keys. 5. Pin GitHub-hosted content to a full commit hash instead of a mutable branch such as `main`. 6. Replace PowerShell `Invoke-Expression` with a locally downloaded, signature-verified script. 7. For container builds, pin scripts and base dependencies to immutable versions so builds remain reproducible. 8. Amend `SKILL.md` so exact reproduction is subordinate to security review. The Skill should warn users and provide a verified alternative rather than automatically presenting `curl | sh` or `iwr | iex`. 9. Run installers under the least-privileged account possible and require explicit confirmation before service installation or privilege elevation. A safer general pattern is: ```sh curl -fL --proto '=https' --tlsv1.2 \ -o install.sh \ 'https://example.invalid/releases/vX.Y.Z/install.sh' printf '%s %s\n' 'PUBLISHED_SHA256' 'install.sh' | sha256sum --check - less install.sh bash install.sh ``` The placeholder URL, release, and checksum must be replaced with publisher-provided immutable values.

T03 · Remote Payload Retrieval and Execution

Error
Location
docs/13-deploy.md:83
Finding
Deployment Documentation Executes Multiple Mutable Third-Party Scripts Without Integrity Verification## Vulnerability Details **File Location**: `docs/13-deploy.md:83, 1277, 2058-2069, 2375, 2432, 2721-2725, 2772` **Vulnerability Type**: Remote payload retrieval and immediate execution during deployment **Risk Level**: High ### Vulnerable Code ```sh curl -fsSL https://get.docker.com | sh ``` ```sh curl -fsSL https://openclaw.ai/install.sh | bash ``` ```sh curl -fsSL https://tailscale.com/install.sh | sh ``` ```sh curl -fsSL https://deb.nodesource.com/setup_22.x | bash - ``` ### Technical Analysis The deployment instructions execute scripts from several independent external trust domains. None of the identified commands pins the returned payload to a reviewed digest or verifies a cryptographic signature before execution. Deployment scripts commonly configure package repositories, install system packages, alter networking, and register services. They are also frequently run with elevated privileges. A compromise of any one upstream endpoint can therefore cross the intended least-privilege boundary and affect the entire deployed host. The behavior is relevant to the declared deployment functionality, but direct execution of mutable network content is not the minimum privilege or minimum trust necessary to accomplish installation. Verified package repositories, signed release artifacts, and pinned versions can provide the same functionality with substantially less supply-chain risk. ### Attack Path 1. A user requests VPS, Docker, Tailscale, Node.js, or OpenClaw deployment guidance. 2. The Skill reproduces one of the remote-script pipelines from `docs/13-deploy.md`. 3. The user runs the command, potentially through `sudo` or in a privileged provisioning environment. 4. A compromised upstream server or publisher account supplies malicious shell content. 5. The interpreter executes the response with deployment privileges. 6. The malicious payload modifies package sources, system binaries, networking, cre ...[truncated 558 chars]
Remediation
## Remediation Suggestions - Replace remote bootstrap scripts with signed operating-system packages or documented manual repository setup. - Pin Docker, Node.js, Tailscale, and OpenClaw installations to explicit versions. - Verify repository signing keys through authenticated, documented fingerprints. - Download scripts first and validate a publisher-provided checksum or signature before execution. - Avoid running network-fetched scripts directly under `sudo` or as root. - Separate package installation, network configuration, and service enablement into explicit reviewable steps. - Require user confirmation before commands that modify repositories, firewall rules, routing, or startup services. - Add a security warning to each affected documentation section explaining that HTTPS alone does not validate a mutable script. - In automated provisioning, mirror approved artifacts into a controlled internal repository and enforce digest pinning.

T03 · Remote Payload Retrieval and Execution

Error
Location
docs/19-troubleshooting.md:426
Finding
Troubleshooting Guidance Repeatedly Reinstalls Software Through Unverified Remote Shell Pipelines## Vulnerability Details **File Location**: `docs/19-troubleshooting.md:426, 450, 557-561, 590, 609-621, 678, 1492` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```sh curl -fsSL https://openclaw.ai/install.sh | bash -s -- --install-method git ``` ```sh curl -fsSL https://openclaw.ai/install.sh | bash ``` ```sh curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/install.sh | bash -s -- --beta ``` ```sh curl -fsSL --proto '=https' --tlsv1.2 https://openclaw.ai/install.sh | bash -s -- --install-method git ``` ```sh curl -fsSL https://openclaw.ai/install.sh | bash -s -- --verbose ``` ```sh curl -fsSL https://openclaw.ai/install.sh | bash -s -- --beta --verbose ``` ```sh curl -fsSL https://openclaw.ai/install.sh | bash -s -- --install-method git --verbose ``` ```sh curl -fsSL https://tailscale.com/install.sh | sh ``` ### Technical Analysis Troubleshooting guidance is especially sensitive because users may execute corrective commands quickly, with elevated privileges, or after disabling safeguards in an attempt to restore service. These commands directly execute mutable remote content and provide no integrity check or local review opportunity. The beta installation command increases exposure by explicitly selecting a less stable release channel. The `--verbose` option may also expose additional environment or diagnostic information in terminal logs, although the reviewed evidence does not establish secret leakage by itself. Reinstalling or repairing software is within the documentation's purpose, but immediate remote execution is not necessary. A pinned and verified installer can perform the same recovery operation while maintaining reviewability and artifact integrity. ### Attack Path 1. An OpenClaw installation fails or exhibits a gateway problem. 2. The user asks the Skill for troubleshooting assistance. 3 ...[truncated 1064 chars]
Remediation
## Remediation Suggestions - Provide version-specific, checksum-verified recovery packages. - Separate diagnosis from reinstallation; do not use a reinstall pipeline as the default troubleshooting action. - Download recovery scripts to disk, verify their signatures, and display them for review. - Prefer stable releases for recovery unless beta behavior is explicitly required and acknowledged. - Warn users not to run verbose diagnostics in public logs and to redact credentials before sharing output. - Require backups of configuration and credentials before repair operations. - Document rollback procedures and expected file or service changes. - Update the Skill instructions to allow safe transformation of hazardous commands instead of requiring verbatim reproduction.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (674)

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/ -->

# OpenClaw - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
{ channel: "whatsapp", accountId: "biz" } },

    // Optional per-peer override (example: send a specific group to work agent).
    {
      agentId: "work",
      match: {
        channel: "whatsapp",
        accountId: "personal",
        peer: { kind: "group", id: "1203630...@g.us" },
      },
    },
  ],

  // Off by default: agent-to-agent messaging must be explicitly enabled + allowlisted.
  tools: {
    agentToAgent: {
      enabled: false,
      allow: ["home", "work"],
    },
  },

  channels: {
    whatsapp: {
      accounts: {
        personal: {
          // Optional override. Default: ~/.openclaw/credentials/whatsapp/personal
          // authDir: "~/.openclaw/credentials/whatsapp/personal",
        },
        biz: {
          // Optional override. Default: ~/.openclaw/credentials/whatsapp/biz
          // authDir: "~/.openclaw/credentials/whatsapp/biz",
        },
      },
    },
  },
}
```

## Example: WhatsApp daily chat + Telegram deep work

Split by channel: route What
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/start/onboarding-overview -->

# Onboarding Overview - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/start/wizard-cli-automation -->

# CLI Automation - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/start/openclaw -->

# Personal Assistant Setup - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/start/hubs -->

# Docs Hubs - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/architecture -->

# Gateway Architecture - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/architecture -->

# Gateway Architecture - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/context -->

# Context - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Self-Modification

High
Category
Rogue Agent
Content
*   **Tooling**: current tool list + short descriptions.
*   **Safety**: short guardrail reminder to avoid power-seeking behavior or bypassing oversight.
*   **Skills** (when available): tells the model how to load skill instructions on demand.
*   **OpenClaw Self-Update**: how to run `config.apply` and `update.run`.
*   **Workspace**: working directory (`agents.defaults.workspace`).
*   **Documentation**: local path to OpenClaw docs (repo or npm package) and when to read them.
*   **Workspace Files (injected)**: indicates bootstrap files are included below.
Confidence
90% confidence
Finding
The system prompt documentation explicitly includes self-update actions such as `config.apply` and `update.run`. In an agent connected to chat channels and tools, normalizing self-modification increases risk that prompt injection or malicious users can steer the system into changing its own configuration, policies, or code paths.

Self-Modification

High
Category
Rogue Agent
Content
OpenClaw can render smaller system prompts for sub-agents. The runtime sets a `promptMode` for each run (not a user-facing config):

*   `full` (default): includes all sections above.
*   `minimal`: used for sub-agents; omits **Skills**, **Memory Recall**, **OpenClaw Self-Update**, **Model Aliases**, **User Identity**, **Reply Tags**, **Messaging**, **Silent Replies**, and **Heartbeats**. Tooling, **Safety**, Workspace, Sandbox, Current Date & Time (when known), Runtime, and injected context stay available.
*   `none`: returns only the base identity line.

When `promptMode=minimal`, extra injected prompts are labeled **Subagent Context** instead of **Group Chat Context**.
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/session-pruning -->

# Session Pruning - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/start/bootstrapping -->

# Agent Bootstrapping - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/start/bootstrapping -->

# Agent Bootstrapping - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/oauth -->

# OAuth - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Credential Access

High
Category
Privilege Escalation
Content
3.  try to capture callback on `http://127.0.0.1:1455/auth/callback`
4.  if callback can’t bind (or you’re remote/headless), paste the redirect URL/code
5.  exchange at `https://auth.openai.com/oauth/token`
6.  extract `accountId` from the access token and store `{ access, refresh, expires, accountId }`

Wizard path is `openclaw onboard` → auth choice `openai-codex`.
Confidence
87% confidence
Finding
The docs describe storing access and refresh tokens after OAuth exchange. In context this is expected functionality, but when combined with broad tool access and readable docs injected into agent context, it increases the chance that a prompt-injected agent will seek out those stored tokens on disk.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/memory -->

# Memory - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/retry -->

# Retry Policy - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/messages -->

# Messages - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Credential Access

High
Category
Privilege Escalation
Content
*   `~/.openclaw/credentials/<channel>-allowFrom.json` (default account)
    *   `~/.openclaw/credentials/<channel>-<accountId>-allowFrom.json` (non-default accounts)
*   **Model auth profiles**: `~/.openclaw/agents/<agentId>/agent/auth-profiles.json`
*   **File-backed secrets payload (optional)**: `~/.openclaw/secrets.json`
*   **Legacy OAuth import**: `~/.openclaw/credentials/oauth.json` More detail: [Security](https://docs.openclaw.ai/gateway/security#credential-storage-map).

## Updating (without wrecking your setup)
Confidence
84% confidence
Finding
The documentation enumerates precise credential and secret storage locations, including file-backed secrets and auth profiles. In isolation that is normal admin documentation, but in an agent skill context it materially lowers the effort for a compromised or prompt-injected agent to target high-value files for theft.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/date-time -->

# Date and Time - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/typebox -->

# TypeBox - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/timezone -->

# Timezones - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/typing-indicators -->

# Typing Indicators - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
---

<!-- SOURCE: https://docs.openclaw.ai/concepts/model-providers -->

# Model Providers - OpenClaw
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.exposed_resource_identifier, suspicious.exposed_secret_literal (+2 more)

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
docs/02-installation.md:1731

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical
Code
suspicious.exposed_resource_identifier
Location
docs/04-channels.md:1884

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/03-gateway.md:238

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/05-providers.md:203

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/06-tools.md:2048

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/09-nodes.md:762

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/19-troubleshooting.md:1328

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/20-experiments.md:1665

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
docs/01-core-concepts.md:2828

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
docs/03-gateway.md:640

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
docs/04-channels.md:1976

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
docs/02-installation.md:960