Security audit

botlearn-healthcheck

Security checks for vulnerabilities and agentic risk

Overview

This health-check skill mostly matches its purpose, but it collects sensitive local data, contacts external registries despite saying it will not, and recommends risky forced installs and persistent automation.

Review carefully before installing. This skill should only be used if you are comfortable with broad local inspection of your OpenClaw home, logs, config, workspace identity files, and secret-adjacent files. Do not approve forced package installs, pipe-to-shell commands, cron creation, report cleanup, or .env edits unless you have separately reviewed the command, source, rollback, and exact files affected. Treat generated HTML reports as untrusted until dynamic output is escaped.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources

Findings (9)

T03 · Remote Payload Retrieval and Execution

Error

Location: check_skills.md:69
Finding: Remote Installer Content Is Piped Directly into Shell Interpreters
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: check_skills.md:190
Finding: Unpinned Third-Party Skills Are Installed with Security Prompts Disabled
Content: View full analysis
--force ``` ```text `--force` skips interactive risk prompts for trusted botlearn skills. ``` ```javascript // check_skills.md:196-203 let d=''; process.stdin.on('data',c=>d+=c).on('end',()=>{ const skills = JSON.parse(d); const names = skills.map(s => typeof s==='string' ? s : s.name).filter(Boolean); names.forEach(n => console.log('clawhub install ' + n + ' --force')); }); ``` ```bash # fix_cases.md:907-913 clawhub install @botlearn/botlearn --force clawhub install @botlearn/botlearn-assessment --force clawhub install @botlearn/botlearn-healthcheck --force clawhub install @botlearn/botlearn-selfoptimize --force clawhub install @botlearn/botlearn-reminder --force clawhub install @botlearn/botlearn-certify --force ``` ### Technical Analysis The installation commands do not pin package versions or integrity hashes and deliberately use `--force` to bypass interactive risk warnings. The bulk-command generator additionally converts dynamic registry search results into forced installation commands. The assertion that all BotLearn packages are trusted is not a technical integrity control. It does not protect against publisher-account compromise, registry compromise, malicious package updates, dependency substitution, or a newly compromised release. ### Attack Path 1. An attacker compromises a registry entry, publisher account, package dependency, or search result. 2. The compromised package appears in `clawhub search botlearn --json`. 3. The Skill generates or recommends an installation command using the returned package name. 4. The `--force` option suppresses the normal risk prompt. 5. The unpinned current pac ...[truncated 519 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: check_skills.md:153
Finding: Health Scoring Is Manipulated to Promote Vendor-Specific Packages
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate-report.sh:137
Finding: Persistent HTML Reports Render Diagnostic Data Without Escaping
Content: View full analysis
{ const color = statusColor[d.status] || "#94a3b8"; const icon = statusIcon[d.status] || "❓"; return `

${icon}

${d.label}

${d.message}

`; }).join("\n"); ``` ```javascript for (const d of problemDims) { for (const issue of (d.issues || []).filter(i => i.severity !== "info")) { idx++; const color = statusColor[d.status] || "#94a3b8"; issueRows.push( `${idx}${statusIcon[d.status]}` + `${d.label}${issue.msg}${issue.fix_ref || "—"}` ); } } ``` ```javascript const outPath = outDir + "/report.html"; fs.writeFileSync(outPath, generatedHtml); ``` ### Technical Analysis The renderer inserts `d.label`, `d.message`, `issue.msg`, and `issue.fix_ref` directly into an HTML document. No HTML encoding or sanitization is applied. The values can be influenced by data derived from logs, configuration, Skill metadata, command output, and model-generated analysis. A crafted string containing HTML event handlers or active markup can therefore be persisted into the generated report. The report is explicitly intended for browser viewing, making the issue a stored client-side injection vulnerability. ### Attack Path 1. An attacker causes a log entry, Skill name, metadata field, configuration value, or diagnostic message to contain malicious HTML. 2. The collector ingests the attacker-controlled value. 3. Domain analysis incorporates that value into a label, mess ...[truncated 699 chars]
Remediation: View remediation
`, `"`, and `'`. - Use a trusted templating engine with automatic escaping. - Construct DOM text nodes rather than concatenating HTML strings. - Restrict status values to a strict allowlist. - Sanitize any field that intentionally permits limited markup. - Add a restrictive Content Security Policy that blocks inline scripts and remote resources. - Add regression tests using malicious labels, messages, and fix references. - Escape Markdown table delimiters and control characters in the Markdown renderer as well. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: data_collect.md:79
Finding: Raw Secret-Bearing Configuration Is Loaded into Agent Context
Content: View full analysis
/dev/null # Fallback: also try $HOME/.openclaw/config/openclaw.json ``` ```text Store raw JSON content as `DATA.openclaw_json`. Purpose: cross-validate against `DATA.config` script output; catch any unusual overrides. ``` ```bash cat "${OPENCLAW_HOME:-$HOME/.openclaw}/agent/models.json" 2>/dev/null ``` ### Technical Analysis The protocol directs the Agent to read and retain the entire raw OpenClaw configuration. Such configuration may contain channel tokens, provider credentials, API keys, authentication settings, endpoint information, or other secrets. The project contains a rule against printing credential values, but that rule applies after ingestion. It does not prevent credentials from entering model context, traces, provider logs, or subsequent model processing. A structured configuration collector already exists, so raw ingestion is not necessary to perform most health checks. ### Attack Path 1. A credential is stored in `openclaw.json` or a related model configuration. 2. The collection protocol reads the complete file. 3. The raw value is stored in `DATA.openclaw_json` or `DATA.models`. 4. Malicious contextual content, prompt injection, accidental reporting, or model logging causes the secret to be exposed. 5. An attacker uses the disclosed credential against the associated service. ### Impact Assessment Potentially exposed data includes: - OpenClaw gateway authentication tokens. - Channel or messaging-service credentials. - Model-provider API keys. - Internal endpoint and topology information. - Configuration values that facilitate further attacks. The exact privilege obtained depends on the exposed credential, but it may include access to messagi ...[truncated 73 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: data_collect.md:197
Finding: Full Personal Workspace Identity Files Are Collected Beyond Diagnostic Need
Content: View full analysis
/dev/null || echo "[MISSING]" echo "=== END ===" done ``` The protocol stores the full content: ```json { "agent_md": { "exists": true, "word_count": 350, "content": "..." }, "soul_md": { "exists": true, "word_count": 120, "content": "..." }, "user_md": { "exists": false, "word_count": 0, "content": null }, "identity_md": { "exists": true, "word_count": 85, "content": "..." }, "tool_md": { "exists": false, "word_count": 0, "content": null } } ``` ### Technical Analysis The stated diagnostic goals are presence checks, word counts, section-heading checks, and content-depth assessment. Those properties can be calculated locally without transferring complete personal files into Agent context. `user.md`, `soul.md`, and `identity.md` can contain user profiles, preferences, identity details, behavioral instructions, and other private information. Reading their complete content exceeds the minimum data access required for a system health report. These files may also contain adversarial instructions. Loading them as context creates an additional prompt-injection surface during a privileged diagnostic workflow. ### Attack Path 1. Personal or maliciously crafted content exists in a workspace identity file. 2. The health check reads the entire file rather than computing local metadata. 3. Full content enters the Agent's active context. 4. Embedded instructions influence analysis, request sensitive actions, or induce disclosure. 5. Personal information may be summarized, logged, or propagated into reports. ### Impact Assessment The behavior may expose: - Us ...[truncated 330 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/collect-skills.sh:204
Finding: Collection Performs Undisclosed External Registry Requests
Content: View full analysis
/dev/null; then clawhub_available="true" if clawhub ping 2>/dev/null || { clawhub info --json 2>/dev/null | grep -q '"registry"'; }; then registry_reachable="true" can_install="true" elif curl -s --connect-timeout 5 --max-time 8 \ "https://registry.clawhub.io" &>/dev/null; then registry_reachable="true" can_install="true" fi fi ``` ```bash if command -v clawhub &>/dev/null; then botlearn_search_ran="true" raw_search=$(clawhub search botlearn --json 2>/dev/null || echo "[]") fi ``` The safety notice states: ```text No outbound network requests are made outside the local OpenClaw gateway. ``` ### Technical Analysis The implementation contacts an external registry during routine collection despite an explicit claim that no such outbound requests occur. The external connectivity test and vendor search are not necessary for assessing local system health. No explicit credential exfiltration was found in these commands. Nevertheless, they disclose request metadata and allow an external service to influence discovery output used by later recommendations. ### Attack Path 1. A user invokes the health check believing it is local-only. 2. `collect-skills.sh` executes `clawhub ping`, `clawhub info`, registry `curl`, or `clawhub search`. 3. The remote service observes the source IP, request timing, client behavior, and search term. 4. A compromised registry can return manipulated discovery data. 5. The returned data contributes to forced-install recommendations. ### Impact Assessment The behavior can disclose: - Public IP address and request timing. - Use of OpenClaw and ClawHub. - BotLearn package-search activity. - Client ...[truncated 143 chars]
Remediation: View remediation

T06 · System Persistence

Warning

Location: fix_cases.md:995
Finding: Health Workflow Encourages Installation of Persistent Autonomous Scheduled Tasks
Content: View full analysis
$OPENCLAW_HOME/cron/healthcheck.json << 'EOF' { "name": "daily-healthcheck", "schedule": "0 9 * * *", "command": "health check", "enabled": true } EOF cat > $OPENCLAW_HOME/cron/selfoptimize.json << 'EOF' { "name": "weekly-selfoptimize", "schedule": "0 10 * * 1", "command": "self optimize", "enabled": true } EOF openclaw cron reload openclaw cron list ``` The autonomy scoring penalizes systems with no scheduled tasks: ```markdown | 0 tasks in cron directory | ⚠️ | -10 | | cron directory missing | ⚠️ | -5 | ``` ### Technical Analysis A one-time health checker does not need recurring self-optimization privileges. Nevertheless, the scoring model treats the lack of scheduled jobs as an unhealthy condition and proposes persistent daily and weekly tasks as remediation. `flow_fix.md` requires user confirmation before modification, which reduces immediate risk. However, the health penalty can pressure users to approve cross-session autonomous execution. The scheduled command can later execute changed Skill logic without renewed review. ### Attack Path 1. A normal system has no OpenClaw cron tasks. 2. The health checker lowers the autonomy score. 3. The report recommends creating recurring health and self-optimization jobs. 4. The user approves the proposed fix. 5. JSON task definitions persist under `$OPENCLAW_HOME/cron`. 6. OpenClaw reloads the tasks and executes them in future sessions. 7. If the invoked Skill changes or becomes compromised, malicious behavior runs automatically. ### Impact Assessment The scheduled tasks can provide: - Cross-session persistence within OpenClaw. - Repeated execution under the Agent's permissions. - Autonomous access to configuration, me ...[truncated 240 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: fix_cases.md:1120
Finding: Persistent Environment Modification Has an Incomplete Rollback
Content: View full analysis
> $OPENCLAW_HOME/.env # If segfault from native module: rebuild cd $OPENCLAW_HOME npm rebuild # Restart openclaw restart ``` The documented rollback is: ```bash unset NODE_OPTIONS openclaw restart ``` ### Technical Analysis The fix appends a persistent setting to `$OPENCLAW_HOME/.env`, but the rollback only removes the variable from the current process environment. It does not remove the appended line. Consequently, the setting can return when the environment file is loaded again. Repeated application also creates duplicate entries. The command does not back up the file, preserve or verify its permissions, or check for a pre-existing user-defined value. The `.env` access itself is reasonable for persistent runtime configuration, but the implementation and rollback are unsafe. ### Attack Path 1. The health check identifies an out-of-memory or segmentation-fault condition. 2. The user approves the proposed fix. 3. The command appends `NODE_OPTIONS` to `.env`. 4. The user later invokes the documented rollback. 5. `unset` affects only the current environment; the file remains modified. 6. On the next environment load or restart, the setting becomes active again. ### Impact Assessment The issue can cause: - Persistent and unexpected Node.js runtime behavior. - Increased memory reservation or pressure. - Duplicate or conflicting environment settings. - Misleading rollback status. - Potential disruption to every Node.js process that consumes the environment file. It does not directly grant additional privileges to an attacker, but it violates safe and reversible configuration practices. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (82)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description promises a comprehensive OpenClaw health inspector spanning hardware, config, security, skills, and autonomy, with broad diagnostic and troubleshooting behavior. The supplied code only invokes openclaw channels list and parses the textual output into structured JSON. It gathers channel status, auth providers, plugin registration, config warnings, usage text, and version/commit info. While some of this loosely overlaps with config/security/skills metadata, the code does not examine hardware, general system state, or autonomy, and it does not perform remediation. Its actual scope is much narrower and centered on channel-related CLI output parsing, so the description materially overstates the behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description claims a comprehensive health inspector spanning hardware, config, security, skills, and autonomy for OpenClaw instances. The provided code only reads and validates the OpenClaw configuration file and optionally invokes openclaw config validate. Its analysis is confined to config sections such as gateway, agents, tools, messages, and session, with a few cross-field checks that touch on security exposure and heartbeat behavior. It does not inspect hardware, system status, runtime health, installed skills behavior, or general troubleshooting state. While the code does cover part of the declared config/security/autonomy scope, the declared primary purpose is materially broader than the actual implementation, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code is related to system health collection, so it partially aligns with the declared health-check theme, especially the hardware/domain inventory aspect. However, the declared description promises a broader autonomous health inspector across five domains including config, security, skills, and autonomy, and suggests diagnostic/troubleshooting behavior. The supplied code only gathers environment metadata and resource stats, plus versions of relevant tools. It performs no checks, scoring, validation, remediation, or domain-specific inspection for security, skills, or autonomy. Therefore the description materially overstates the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description promises a comprehensive autonomous health inspector spanning five domains, but the supplied code implements a much narrower gateway/CLI health collection utility. Its primary behaviors are: run openclaw health --json, parse openclaw.json for gateway settings, probe localhost gateway endpoints (/, /openclaw, /hooks) via curl, and report versions for clawhub and openclaw. This supports a partial configuration/connectivity check, but not the advertised hardware, skills, autonomy, or substantive security diagnostics. Additionally, while permission declarations are empty, the script reads a local config file and performs local network probing; that inconsistency strengthens the mismatch, though the main issue is the materially narrower purpose than declared.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The declared description promises a comprehensive health inspector spanning five domains (hardware, config, security, skills, autonomy) for OpenClaw instances. The supplied code does something narrower: it only inspects files in the OpenClaw logs directory and derives diagnostics from log contents. It does not check hardware resources, configuration files, security settings, installed skills, or autonomy subsystems directly. While log analysis is relevant to diagnostics and health reporting, the actual behavior is only one slice of the declared scope, making the description materially broader than what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The declared description presents a broad autonomous health inspector spanning five domains (hardware, config, security, skills, autonomy). The supplied code chunk, however, implements only the security portion: platform security audit ingestion, sensitive file permission checks, secret/credential scanning in files, and gateway exposure analysis. That is a materially narrower and different actual behavior than the declared multi-domain healthcheck. The triggers for diagnostics/health checks are broadly compatible, but the code does not support most of the promised domains. Therefore this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code is narrowly focused on skill inventory and tooling/ecosystem discovery, not a general system health inspector across the five declared domains. While it does partially relate to the 'skills' domain, it does not implement hardware checks, substantive config diagnostics, security checks, or autonomy analysis. It also performs undeclared capability checks against the local gateway /tools endpoint and clawhub/registry availability, plus BotLearn package discovery. Therefore the declared description materially overstates and misrepresents the code's actual primary behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents the skill as an autonomous health inspector/doctor for OpenClaw instances. However, the provided code only formats existing analysis data from a JSON input into Markdown and HTML reports. It reads a file, builds status summaries and issue tables, and writes report files. There is no evidence of collecting system state, running checks across the claimed domains, inspecting security/configuration/hardware, or fixing issues. While report generation could be a supporting part of a healthcheck skill, this chunk’s actual primary behavior is reporting, not inspection. Therefore the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger set includes broad conversational phrases such as 'diagnose', 'doctor', 'what's wrong', and 'fix my setup', which can activate the skill during unrelated conversations. Because activation leads to autonomous system inspection and data collection, accidental invocation can expose local configuration, logs, identity listings, and security-relevant metadata without the user intending a deep audit.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The command chains curl output directly into sudo bash, combining network retrieval, shell execution, and privilege escalation in one step. In the context of a diagnostic skill that may be used operationally, this pattern is especially risky because it lowers friction for dangerous execution and could be adopted verbatim by users or downstream automation.
Content: Scanner excerpt · check_hardware.md (reported line 73)May include surrounding context.
md
| < 16 | ❌ | -40 | Unsupported — OpenClaw will not run | **Fix (darwin):** `brew install node` or `nvm install --lts` **Fix (linux):** `curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo bash -` ---

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The command curl -fsSL https://clawhub.io/install | bash executes remote script content directly in a shell without prior verification. This is a well-known dangerous pattern because compromise of the endpoint, transport, or served content can lead to arbitrary code execution on the host.
Content: Scanner excerpt · check_skills.md (reported line 69)May include surrounding context.
md
| `clawhub_available = true`, `registry_reachable = false` | ⚠️ | -10 — clawhub present but offline | | `can_install = true` | ✅ | 0 — self-improvement is fully enabled | **Fix (clawhub missing):** `npm install -g clawhub` or `curl -fsSL https://clawhub.io/install | bash` **Fix (registry unreachable):** Check internet connectivity; try `clawhub ping` ---

Chaining Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: ls ... | tail ... | xargs rm -f is a brittle deletion pipeline that can mis-handle filenames with whitespace/newlines and can behave unexpectedly when globs do not match. In an autonomous healthcheck/fix workflow, destructive one-liners are more dangerous because users may execute them during routine maintenance with limited review.
Content: Scanner excerpt · fix_cases.md (reported line 62)May include surrounding context.
md
find $OPENCLAW_HOME/logs/ -name "*.log" -mtime +7 -exec gzip {} \; # 3. Clean old health reports (keep last 10) ls -t $OPENCLAW_HOME/memory/health-reports/*.md | tail -n +11 | xargs rm -f ls -t $OPENCLAW_HOME/memory/health-reports/*.html | tail -n +11 | xargs rm -f # 4. Prune npm cache if skills use node_modules

Chaining Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: This second xargs rm -f cleanup command has the same risk profile: unsafe filename handling and potentially destructive bulk deletion in a maintenance context. Because it targets generated reports, mistakes may erase diagnostic history needed for incident response or troubleshooting.
Content: Scanner excerpt · fix_cases.md (reported line 63)May include surrounding context.
md
# 3. Clean old health reports (keep last 10) ls -t $OPENCLAW_HOME/memory/health-reports/*.md | tail -n +11 | xargs rm -f ls -t $OPENCLAW_HOME/memory/health-reports/*.html | tail -n +11 | xargs rm -f # 4. Prune npm cache if skills use node_modules npm cache clean --force

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · fix_cases.md (reported line 1037)May include surrounding context.
Rollback:

bash
rm $OPENCLAW_HOME/cron/<task>.json openclaw cron reload

Chaining Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The assessment cleanup command again chains ls, tail, and xargs rm -f, creating the same unsafe bulk-deletion pattern. Within a self-managing skill, this is particularly risky because it normalizes destructive maintenance actions that could delete the wrong files or important audit artifacts.
Content: Scanner excerpt · fix_cases.md (reported line 1060)May include surrounding context.
md
# 2. Archive old assessment results (keep last 20) cd $OPENCLAW_HOME/memory/ ls -t assessments/*.md | tail -n +21 | xargs rm -f # 3. Compress old health reports (keep last 10 uncompressed) cd $OPENCLAW_HOME/memory/health-reports/

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · fix_cases.md (reported line 1131)May include surrounding context.
md
export NODE_OPTIONS="--max-old-space-size=4096" # 3. Add to openclaw startup config echo 'export NODE_OPTIONS="--max-old-space-size=4096"' >> $OPENCLAW_HOME/.env # 4. If segfault from native module: rebuild cd $OPENCLAW_HOME

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/collect-security.sh (reported line 79)May include surrounding context.
sh
const sensitiveTargets = [ HOME + "/openclaw.json", HOME + "/identity", HOME + "/.env" ]; // Find auth-profiles.json in agent dirs

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/collect-security.sh (reported line 193)May include surrounding context.
sh
const sensitiveTargets = [ HOME + "/openclaw.json", HOME + "/identity", HOME + "/.env" ]; // Find auth-profiles.json in agent dirs

Credential Access

High

Category: Privilege Escalation
Confidence: 83% confidence
Finding: This code explicitly includes configuration files and .env files in a credential exposure scan, meaning the skill reads potentially secret-bearing files from the user's OpenClaw home and processes their contents. Although values are redacted in output, the agent still gains access to the plaintext secrets during scanning, which increases privacy risk and could expose credentials if the process, logs, or downstream handling are compromised.
Content: Scanner excerpt · scripts/collect-security.sh (reported line 166)May include surrounding context.
sh
// Scan: config files, .env, log files (limited) const scanDirs = [ { dir: HOME, exts: [".json", ".yaml", ".yml", ".toml", ".env", ".conf"], depth: 1 }, { dir: HOME + "/config", exts: ["*"], depth: 2 }, { dir: HOME + "/logs", exts: [".log", ".err.log"], depth: 1 } ];

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: This line adds ~/.env to the scan target set, causing the script to open and inspect a common secret store for API keys, passwords, and tokens. In the context of an autonomous health-check skill, reading such files is sensitive behavior because it broadens the agent's access to credentials beyond what's needed for a basic system check.
Content: Scanner excerpt · scripts/collect-security.sh (reported line 192)May include surrounding context.
sh
collect(dir, depth); } // Also check .env at home level const envFile = HOME + "/.env"; if (fs.existsSync(envFile)) scanTargets.add(envFile);

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/collect-skills.sh (reported line 215)May include surrounding context.
sh
if clawhub ping 2>/dev/null || { clawhub info --json 2>/dev/null | grep -q '"registry"'; }; then registry_reachable="true" can_install="true" elif curl -s --connect-timeout 5 --max-time 8 "https://registry.clawhub.io" &>/dev/null; then registry_reachable="true" can_install="true" fi

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README describes broad autonomous collection of system data, direct reading of config/state files, and writing reports to disk, but it does not present a prominent upfront warning about the sensitivity of the data being gathered and persisted. Users may invoke the skill without realizing it can inspect secrets-adjacent files, logs, and configuration and store reports under a predictable path, increasing privacy and data exposure risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger set includes very broad phrases such as "doctor," "diagnose," "check system," and "what's wrong," which can match ordinary user requests and cause the skill to activate unexpectedly. In this skill's context, unintended activation is more dangerous because the skill is designed to collect wide-ranging system, configuration, log, and security data and may later guide remediation actions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to read local files, inspect environment data, and invoke shell/CLI commands, but it declares no tool scope or permission boundaries. That creates hidden capability expansion: a user invoking a benign-sounding health check could cause broad host inspection without clear authorization controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description frames activation around broad diagnostics and system-health requests without clear boundaries, increasing the chance that users invoke it without understanding its invasive collection scope. In this skill, that matters because activation can cascade into shell execution, filesystem inspection, log access, and persistent report generation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.