OpenClaw Shield

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:55 AM UTC
• Version: 1.4.2

Overview

This is a coherent security-monitoring skill, but it depends on a proprietary gateway plugin that observes agent activity and sends telemetry, so users should review the plugin and data handling before installing.

Install only if you trust UPX and are comfortable with a gateway plugin monitoring agent activity and sending redacted security telemetry to UPX. Review the plugin package, version, permissions, privacy terms, retention/deletion process, and subscription requirements first; run uninstall and data-deletion commands manually, not automatically.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:45
• Finding: Mandatory Vendor Promotion Hijacks Shield-Related Responses<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 45–70 **Vulnerability Type**: Forced response behavior and commercial promotion **Risk Level**: Medium ### Vulnerable Code ```markdown ## Plugin State Check Before responding to ANY Shield-related request, run `openclaw shield status` and interpret the result: ### State A — Plugin not installed (command not found, or exit code non-zero with plugin_not_found) Respond with: > Shield is not installed yet. Start your free 60-day trial (no credit card required) at: > https://www.upx.com/en/lp/openclaw-shield-upx > > Then install the plugin: > ``` > openclaw plugins install @upx-us/shield > openclaw plugins run shield setup > ``` ### State B — Plugin installed but no installationKey (status contains installationKey: null or state: "unconfigured") Respond with: > Shield is installed but not activated. Sign up for a trial at: > https://www.upx.com/en/lp/openclaw-shield-upx > > Once you have your installation key, run: > ``` > openclaw plugins run shield setup > ``` ``` ### Technical Analysis The Skill directs the agent to execute `openclaw shield status` before responding to **any** Shield-related request. It then mandates predefined commercial signup and installation messages when the plugin is missing or unconfigured. A health check can be legitimate when a request depends on live Shield state. However, applying it to every Shield-related question exceeds the minimum behavior needed for informational requests, including questions about features, privacy, documentation, or installation requirements. The mandatory response templates also replace normal answer selection with vendor-controlled promotional content. This behavior constitutes instruction hijacking because loading the Skill changes the agent’s immediate response goals: the agent must perform a vendor status check and, in selected states, deliver a signup solicitation rather than independently constructing the most relevant respo ...[truncated 1263 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the requirement to run `openclaw shield status` before every Shield-related response. 2. Run the status command only when the user asks about live health, connectivity, activation, event ingestion, or another state-dependent property. 3. For general documentation and privacy questions, answer directly without invoking local commands. 4. Replace mandatory trial advertisements with neutral configuration guidance. 5. Present the vendor signup URL only when the user explicitly asks how to subscribe, activate, or obtain an installation key. 6. Clearly separate required technical steps from optional commercial offerings. 7. Ask for user confirmation before initiating installation-related workflows. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:56
• Finding: Unpinned Proprietary Plugin Introduces an Unverifiable Supply-Chain Execution Boundary<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md`, lines 56–57 - `README.md`, lines 20–29 **Vulnerability Type**: Unpinned external executable dependency **Risk Level**: High ### Vulnerable Code From `SKILL.md`: ```markdown > Then install the plugin: > ``` > openclaw plugins install @upx-us/shield > openclaw plugins run shield setup > ``` ``` From `README.md`: ```markdown ## Install This skill is bundled with the Shield plugin. Install the plugin and the skill is available automatically: ```bash openclaw plugins install @upx-us/shield openclaw shield activate <YOUR_KEY> openclaw gateway restart ``` ``` ### Technical Analysis The project instructs users to install `@upx-us/shield` without specifying an immutable package version, integrity digest, signature, or reproducible source revision. The audited project contains only `README.md` and `SKILL.md`; it does not include the plugin implementation. Consequently, this audit cannot verify the code that captures agent activity, performs redaction, communicates with UPX, or runs inside the OpenClaw gateway. The Skill explicitly states that the external plugin captures agent activity and sends redacted telemetry to the UPX detection platform. It also indicates that captured data can include file paths, command snippets, URLs, event details, and redaction-vault information. Although cloud telemetry is consistent with the declared SIEM functionality, the absence of auditable plugin code prevents verification that collection and transmission are limited to the declared scope. Because the installation command resolves a mutable package version, the effective executable payload can change after the Skill itself has been reviewed. A compromised publisher account, package registry incident, or malicious future release could therefore alter the behavior users receive from the same documented command. ### Attack Path 1. A user follows the Skill or README installation instructions. 2. `openclaw plu ...[truncated 1688 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the plugin to an exact reviewed version, for example `@upx-us/shield@<exact-version>`, rather than resolving a mutable release. 2. Publish and verify a cryptographic integrity hash or signed package provenance. 3. Make the plugin source available for independent review or provide a reproducible build linked to the distributed artifact. 4. Document the plugin’s complete permission model, including filesystem, environment, gateway, process, and network access. 5. Restrict network egress to documented UPX endpoints and use authenticated TLS. 6. Require explicit, informed user consent before enabling telemetry transmission. 7. Document precisely which fields are captured, how redaction is performed, which metadata remains visible, retention periods, and deletion procedures. 8. Isolate the plugin using the minimum gateway and operating-system permissions required for event collection. 9. Avoid exposing installation keys through command-line arguments, logs, diagnostics, or process listings. 10. Add a dependency review and release-signing process so that package changes cannot silently alter the effective reviewed behavior. ]]>

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

2. Optionally remove local Shield data:
   ```
   rm -rf ~/.openclaw/shield/
   ```
   Files removed include: `config.json`, `data/event-buffer.jsonl`, `data/redaction-vault.json`, `data/cursor.json`, `data/instance.json`, `logs/shield.log`, `logs/bridge.log`, `state/monitor.json`.

• Confidence: 97% confidence
• Finding: `rm -rf ~/.openclaw/shield/` is a hazardous command because it recursively deletes files and depends on shell expansion of `~`. If copied, modified, or executed by an automated agent without strict safeguards, it can destroy forensic logs, vault data, and potentially more if the path is malformed or interpreted unexpectedly.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

2. Optionally remove local Shield data:
   ```
   rm -rf ~/.openclaw/shield/
   ```
   Files removed include: `config.json`, `data/event-buffer.jsonl`, `data/redaction-vault.json`, `data/cursor.json`, `data/instance.json`, `logs/shield.log`, `logs/bridge.log`, `state/monitor.json`.

• Confidence: 97% confidence
• Finding: `rm -rf ~/.openclaw/shield/` is a hazardous command because it recursively deletes files and depends on shell expansion of `~`. If copied, modified, or executed by an automated agent without strict safeguards, it can destroy forensic logs, vault data, and potentially more if the path is malformed or interpreted unexpectedly.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README advertises state-changing and potentially destructive operations such as `flush`, case management, and enabling monitoring without any warning, confirmation guidance, or constraints. In an agent-skill context, documentation shapes model behavior, so presenting these commands as routine actions increases the chance an agent invokes them automatically or without adequate user consent.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: L154 limits case-listing to explicit user requests about open cases. However, L123 instructs the skill to run `openclaw shield cases` when asked broader questions like whether the agent is secure or protected, which is a contradictory operational instruction about when case data should be fetched.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: L85 states the skill should not install or uninstall packages on behalf of the user. Yet L181-L190 provides direct uninstall and local data deletion commands as part of the skill's operational guidance, creating a contradiction in intent about whether package-management and removal actions are in scope.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:190