ClawHub
Back to skill

Security audit

Openclaw Create Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but it should be reviewed because it encourages broad cross-agent access and handles Feishu bot credentials with limited safety guidance.

Install only if you intend to let the agent modify OpenClaw configuration, create persistent agent workspaces, bind a Feishu bot, and restart the OpenClaw gateway. Before use, replace subagents.allowAgents ["*"] with an empty list or a narrow allowlist, protect any Feishu appSecret stored in openclaw.json, and prefer pairing or allowlist channel policies for private agents.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:109
Finding

Overbroad Cross-Agent Spawning Permission

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

bash
# 1. 创建目录
mkdir -p ~/.openclaw/workspace/agents/myagent/{memory,diary,output,.openclaw}

# 2. 写入人格文件
cp templates/IDENTITY.md ~/.openclaw/workspace/agents/myagent/

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly recommends configuring subagents.allowAgents as ["*"], which grants a newly created agent unrestricted ability to discover and spawn any other agent. In a multi-agent system, this breaks least-privilege boundaries and can enable lateral movement, privilege amplification, or misuse of more trusted agents if one agent is compromised or behaves unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation normalizes broad multi-agent spawning permissions and even presents [*] as a standard option without meaningful risk guidance. This can lead operators to deploy unsafe trust relationships between agents, increasing the chance of cross-agent abuse, data exposure, or uncontrolled task delegation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The activation phrases are broad enough that the skill may trigger on generic requests like creating an assistant or bot, even when the user did not intend OpenClaw-specific filesystem and configuration changes. Over-broad invocation increases the chance of unintended privileged actions in the wrong context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill recommends subagents.allowAgents: ["*"], granting the new agent unrestricted ability to spawn any other agent. This exceeds the minimum needed to create an agent and weakens containment boundaries, enabling lateral movement or privilege expansion if the new agent is misconfigured, prompt-injected, or compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill tells users to place Feishu appId and especially appSecret directly into configuration without guidance on secret storage, masking, file permissions, or log exposure. This creates a realistic risk of credential leakage through screenshots, version control, backups, shared configs, or overly permissive filesystem access, leading to account or bot compromise.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

Step 1: 创建目录

bash
mkdir -p /root/.openclaw/workspace/agents/writer/{memory,diary,output,.openclaw}

注意：output/ 目录用于存放所有任务/项目的输出文件，遵循 AGENTS.md 中的 Output 文件夹规范。

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

Step 1: 创建目录

bash
mkdir -p /root/.openclaw/workspace/agents/writer/{memory,diary,output,.openclaw}

注意:output/ 目录用于存放所有任务/项目的输出文件,遵循 AGENTS.md 中的 Output 文件夹规范。

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The entire skill description is written in Chinese, with no indication that other languages are supported or that Chinese is required for a region-specific reason. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The manifest frames the skill as creating an agent, directory structure, memory files, config updates, and Feishu bindings. Restarting the gateway is an operational service-management action rather than creation itself, and can impact unrelated workloads; while useful, it is not inherently justified by the narrow creation purpose alone.

Content

No source excerpt is available for this finding.