ClawHub
Back to skill

Security audit

OpenClaw Hook Development

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed developer guide for OpenClaw Gateway hooks, with sensitive examples that users should review before enabling but no evidence of hidden or malicious behavior.

Install only if you intend to build OpenClaw Gateway internal hooks. Before copying the examples, replace placeholders, avoid broad always-on hooks, prefer explicit environment variables or scoped secrets over reading the full OpenClaw config, and review any bootstrapFiles injection because it changes future agent context.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: openclaw-hook
description: Create, debug, and maintain OpenClaw Gateway internal hooks. Use when: (1) creating new hooks for agent events like bootstrap, (2) debugging hook execution issues, (3) understanding hook configuration and event structure, (4) injecting virtual bootstrap files, (5) fixing issues like Telegram notifications not sending, Content-Length errors, or context access problems. Triggers on phrases like "create a hook", "fix hook", "debug hook", "hook not working", "internal hook".
---

# OpenClaw Internal Hook 开发指南
Confidence
87% confidence
Finding
The same persistence concern is present in the duplicated finding: the skill teaches how to register always-on internal hooks via configuration and have them run automatically after gateway restart. In the context of an agent platform, this makes the behavior more security-relevant because future agent sessions may inherit modified context or trigger external communications without fresh user awareness.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: openclaw-hook
description: Create, debug, and maintain OpenClaw Gateway internal hooks. Use when: (1) creating new hooks for agent events like bootstrap, (2) debugging hook execution issues, (3) understanding hook configuration and event structure, (4) injecting virtual bootstrap files, (5) fixing issues like Telegram notifications not sending, Content-Length errors, or context access problems. Triggers on phrases like "create a hook", "fix hook", "debug hook", "hook not working", "internal hook".
---

# OpenClaw Internal Hook 开发指南
Confidence
87% confidence
Finding
The same persistence concern is present in the duplicated finding: the skill teaches how to register always-on internal hooks via configuration and have them run automatically after gateway restart. In the context of an agent platform, this makes the behavior more security-relevant because future agent sessions may inherit modified context or trigger external communications without fresh user awareness.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The description says the skill triggers on phrases like "create a hook", "fix hook", and "debug hook" without narrowing the context to OpenClaw Gateway internal hooks. These phrases are generic enough to match ordinary developer requests about many kinds of hooks, which can cause unintended invocation.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The main title and the surrounding instructional content are presented in Chinese, with no indication that the user can choose another language or locale. This creates a language-policy issue because the skill appears to impose a specific language rather than offering opt-in or documenting a justified locale restriction.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The header comment claims the hook only checks workspace status and sends a Telegram notification, but the code also modifies agent bootstrap state by injecting a virtual file. This undocumented behavior is security-relevant because it changes the agent's inputs and could influence downstream model behavior without operator awareness.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The hook reads a local config file from the user's home directory to extract a Telegram bot token, expanding its access to credential-bearing material beyond the stated workspace-status purpose. Accessing secrets from disk inside a hook increases the blast radius if the hook is modified, abused, or copied into untrusted environments.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code reads a credential-bearing config file to obtain a bot token and then sends runtime-derived information to Telegram without any user-facing notice or approval. Even if the exfiltrated data is limited, silent transfer of workspace/session metadata to an external service is a meaningful privacy and security risk in an agent hook context.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The hook injects HOOK_REMINDER.md into event.context.bootstrapFiles, which alters the prompt/context presented to the agent, yet this side effect is omitted from the documented purpose. Hidden prompt injection capabilities are dangerous because they can steer agent behavior, leak metadata into model context, or create covert policy overrides.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The hook silently injects a virtual bootstrap file containing session key and agent metadata into the agent context. While the content appears innocuous, undisclosed context injection can affect agent decisions and becomes more dangerous in a skill system where bootstrap files are trusted inputs.

Natural-Language Policy Violations

Low
Confidence
93% confidence
Finding
The notification timestamp is hard-coded to use the zh-CN locale and Asia/Shanghai timezone. This imposes a specific language/locale behavior without user opt-in or any documented justification that the hook is intended only for that region or audience.

Natural-Language Policy Violations

Low
Confidence
94% confidence
Finding
The test message hard-codes `toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' })`, which enforces a specific language/locale and regional timezone in generated output. This matches the policy category for locale/language constraints because the script does not offer the user a choice or explain that it is a region-specific tool.

Static analysis

No suspicious patterns detected.