Security audit

OpenClaw Boost Tools

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a local OpenClaw productivity toolkit, but its permission checks are too broad for high-impact commands and it can persist or inject local memory/log data without much user control.

Install only if you are comfortable with local OpenClaw activity logs and memory contents being stored under the skill directory. Do not hook the permission manager into automatic approvals unless you first tighten or remove the Python/Node and curl allow rules. Review memory files before using the inject feature, especially on shared machines or projects containing secrets.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The rule labeled as a read-only Curl rule uses the regex ^curl\s+-s\s+, which only checks for the -s flag and then allows any remaining arguments. That means destructive or side-effecting requests such as POST/PUT/DELETE, authenticated API calls, uploads, or SSRF-style internal fetches can be auto-approved despite being presented as safe.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The rule described as permitting safe Python/Node one-liners actually auto-allows arbitrary code execution whenever the command matches ^(python3|node)\s+(-c|-m)\s+['\"]. Both python3 -c and node -c/-m style patterns can execute attacker-controlled code, spawn subprocesses, modify files, or make network calls, so this bypasses the intended confirmation boundary for highly capable execution primitives.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code explicitly reads memory file contents and formats them for direct context injection, but provides no consent gate, sensitivity filtering, or disclosure that potentially personal or system data will be exposed to the model. In an agent setting, this creates a real privacy and data-minimization risk because unrelated secrets, personal notes, or local configuration details can be surfaced merely by relevance scoring.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The /clear command performs irreversible directory deletion via shutil.rmtree without any confirmation, dry-run, or detailed preview. Although the target paths are fixed to __pycache__ directories, destructive actions exposed through a slash command can still cause unintended data loss or disruption, especially if path assumptions change or symlinks are mishandled elsewhere in the environment.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The tracker persists tool execution metadata to disk, including error text and session identifiers, under a predictable path in the user's home directory without notice, minimization, or access-control handling. Errors and session keys often contain sensitive operational details, tokens, filenames, prompts, or internal identifiers, so this creates a local information disclosure and privacy-retention risk, especially on shared systems or when logs are later exfiltrated.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The design injects full retrieved memory contents into model context, which creates a natural-language exfiltration channel: once in context, sensitive data may be repeated, summarized, or influence downstream tool use. This is more dangerous here because the memory store is under the user's home directory and may contain personal history, project details, or operational notes that were not intended for every query.

Static analysis

No suspicious patterns detected.