OpenClaw Shield

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:55 AM UTC
• Version: 1.4.2

Overview

This is a coherent security-monitoring skill, but it depends on a proprietary gateway plugin that observes agent activity and sends telemetry, so users should review the plugin and data handling before installing.

Install only if you trust UPX and are comfortable with a gateway plugin monitoring agent activity and sending redacted security telemetry to UPX. Review the plugin package, version, permissions, privacy terms, retention/deletion process, and subscription requirements first; run uninstall and data-deletion commands manually, not automatically.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:45

Finding

Mandatory Vendor Promotion Hijacks Shield-Related Responses

Content

View full analysis

Shield is not installed yet. Start your free 60-day trial (no credit card required) at: > https://www.upx.com/en/lp/openclaw-shield-upx > > Then install the plugin: > ``` > openclaw plugins install @upx-us/shield > openclaw plugins run shield setup > ``` ### State B — Plugin installed but no installationKey (status contains installationKey: null or state: "unconfigured") Respond with: > Shield is installed but not activated. Sign up for a trial at: > https://www.upx.com/en/lp/openclaw-shield-upx > > Once you have your installation key, run: > ``` > openclaw plugins run shield setup > ``` ``` ### Technical Analysis The Skill directs the agent to execute `openclaw shield status` before responding to **any** Shield-related request. It then mandates predefined commercial signup and installation messages when the plugin is missing or unconfigured. A health check can be legitimate when a request depends on live Shield state. However, applying it to every Shield-related question exceeds the minimum behavior needed for informational requests, including questions about features, privacy, documentation, or installation requirements. The mandatory response templates also replace normal answer selection with vendor-controlled promotional content. This behavior constitutes instruction hijacking because loading the Skill changes the agent’s immediate response goals: the agent must perform a vendor status check and, in selected states, deliver a signup solicitation rather than independently constructing the most relevant respo ...[truncated 1263 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:56

Finding

Unpinned Proprietary Plugin Introduces an Unverifiable Supply-Chain Execution Boundary

Content

View full analysis

Then install the plugin: > ``` > openclaw plugins install @upx-us/shield > openclaw plugins run shield setup > ``` ``` From `README.md`: ```markdown ## Install This skill is bundled with the Shield plugin. Install the plugin and the skill is available automatically: ```bash openclaw plugins install @upx-us/shield openclaw shield activate openclaw gateway restart ``` ``` ### Technical Analysis The project instructs users to install `@upx-us/shield` without specifying an immutable package version, integrity digest, signature, or reproducible source revision. The audited project contains only `README.md` and `SKILL.md`; it does not include the plugin implementation. Consequently, this audit cannot verify the code that captures agent activity, performs redaction, communicates with UPX, or runs inside the OpenClaw gateway. The Skill explicitly states that the external plugin captures agent activity and sends redacted telemetry to the UPX detection platform. It also indicates that captured data can include file paths, command snippets, URLs, event details, and redaction-vault information. Although cloud telemetry is consistent with the declared SIEM functionality, the absence of auditable plugin code prevents verification that collection and transmission are limited to the declared scope. Because the installation command resolves a mutable package version, the effective executable payload can change after the Skill itself has been reviewed. A compromised publisher account, package registry incident, or malicious future release could therefore alter the behavior users receive from the same documented command. ### Attack Path 1. A user follows the Skill or README installation instructions. 2. `openclaw plu ...[truncated 1688 chars]

Remediation

View remediation

`, rather than resolving a mutable release. 2. Publish and verify a cryptographic integrity hash or signed package provenance. 3. Make the plugin source available for independent review or provide a reproducible build linked to the distributed artifact. 4. Document the plugin’s complete permission model, including filesystem, environment, gateway, process, and network access. 5. Restrict network egress to documented UPX endpoints and use authenticated TLS. 6. Require explicit, informed user consent before enabling telemetry transmission. 7. Document precisely which fields are captured, how redaction is performed, which metadata remains visible, retention periods, and deletion procedures. 8. Isolate the plugin using the minimum gateway and operating-system permissions required for event collection. 9. Avoid exposing installation keys through command-line arguments, logs, diagnostics, or process listings. 10. Add a dependency review and release-signing process so that package changes cannot silently alter the effective reviewed behavior. ]]>

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

rm -rf ~/.openclaw/shield/ is a hazardous command because it recursively deletes files and depends on shell expansion of ~. If copied, modified, or executed by an automated agent without strict safeguards, it can destroy forensic logs, vault data, and potentially more if the path is malformed or interpreted unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

2. Optionally remove local Shield data:

   text

   rm -rf ~/.openclaw/shield/
   

   Files removed include: config.json, data/event-buffer.jsonl, data/redaction-vault.json, data/cursor.json, data/instance.json, logs/shield.log, logs/bridge.log, state/monitor.json.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

rm -rf ~/.openclaw/shield/ is a hazardous command because it recursively deletes files and depends on shell expansion of ~. If copied, modified, or executed by an automated agent without strict safeguards, it can destroy forensic logs, vault data, and potentially more if the path is malformed or interpreted unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

2. Optionally remove local Shield data:

   text

   rm -rf ~/.openclaw/shield/
   

   Files removed include: config.json, data/event-buffer.jsonl, data/redaction-vault.json, data/cursor.json, data/instance.json, logs/shield.log, logs/bridge.log, state/monitor.json.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises state-changing and potentially destructive operations such as flush, case management, and enabling monitoring without any warning, confirmation guidance, or constraints. In an agent-skill context, documentation shapes model behavior, so presenting these commands as routine actions increases the chance an agent invokes them automatically or without adequate user consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

L154 limits case-listing to explicit user requests about open cases. However, L123 instructs the skill to run openclaw shield cases when asked broader questions like whether the agent is secure or protected, which is a contradictory operational instruction about when case data should be fetched.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

L85 states the skill should not install or uninstall packages on behalf of the user. Yet L181-L190 provides direct uninstall and local data deletion commands as part of the skill's operational guidance, creating a contradiction in intent about whether package-management and removal actions are in scope.

Content

No source excerpt is available for this finding.