SilicaClaw Owner Push

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:17 AM UTC
• Version: 2026.3.20-beta.3

Overview

The skill mostly matches its stated monitoring purpose, but it runs a configurable shell command and forwards broadcast content without enforcing the redaction policy.

Review carefully before installing. Use this only on a trusted OpenClaw machine, set narrow include/topic filters, avoid arbitrary OPENCLAW_OWNER_FORWARD_CMD values, and treat forwarded broadcast text as potentially sensitive until redaction is implemented.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/owner-push-forwarder.mjs:223

Finding

Configurable Forwarding Command Is Executed Through a Shell

Content

View full analysis

Vulnerability Details

File Location: scripts/owner-push-forwarder.mjs, lines 223-227; configuration source at line 10
Vulnerability Type: OS command injection through an unvalidated environment variable
Risk Level: High

Vulnerable code:

js

const OWNER_FORWARD_CMD = String(process.env.OPENCLAW_OWNER_FORWARD_CMD || "").trim();

js

const child = spawn(OWNER_FORWARD_CMD, {
  shell: true,
  stdio: ["pipe", "inherit", "inherit"],
  env: process.env,
});

Technical Analysis

The complete value of OPENCLAW_OWNER_FORWARD_CMD is passed to spawn() with shell: true. Consequently, the operating-system shell interprets command separators, substitutions, pipelines, redirections, and other shell syntax contained in the environment variable.

The value is neither validated nor separated into a trusted executable and an explicit argument array. Although the documented value is node scripts/send-to-owner-via-openclaw.mjs, any party or configuration mechanism able to influence the environment variable can replace it with an arbitrary shell expression. Execution occurs when a qualifying broadcast is dispatched.

Attack Path

1. An attacker gains influence over the forwarder's runtime environment, service configuration, launch script, or another source defining OPENCLAW_OWNER_FORWARD_CMD.
2. The attacker sets the variable to a command containing an additional shell payload.
3. The forwarder polls the bridge and identifies a broadcast containing a default or configured high-signal term.
4. dispatchToOwner() passes the attacker-controlled string to spawn() with shell interpretation enabled.
5. The shell executes the injected command with the same operating-system identity and environment as the forwarder.

This issue is configuration-mediated and does not permit broadcast content itself to alter the command string.

Impact Assessment

Successful exploitation provides arbit ...[truncated 546 chars]

Remediation

View remediation

Remediation Suggestions

• Remove shell: true and invoke a fixed, trusted executable using an explicit argument array.
• Prefer directly launching the bundled forwarding script, for example by spawning process.execPath with the resolved script path as an argument.
• If configurability is required, define the executable and arguments in separate configuration fields rather than accepting a shell command string.
• Resolve and validate configurable executable paths against a narrow allowlist of approved binaries or scripts.
• Do not attempt to secure shell execution by escaping selected metacharacters; avoiding the shell is the reliable control.
• Run the forwarder under a dedicated least-privilege account with minimal filesystem, credential, and network access.
• Add tests proving that shell metacharacters and command substitutions are treated as literal arguments and cannot execute secondary commands.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/owner-push-forwarder.mjs:204

Finding

Broadcast Content Is Forwarded Without Required Secret Redaction

Content

View full analysis

Vulnerability Details

File Location: scripts/owner-push-forwarder.mjs, lines 204-215
Vulnerability Type: Sensitive information exposure through unredacted message forwarding
Risk Level: Medium

Vulnerable code:

js

function summarizeForOwner(message) {
  const source = `${message.display_name || "Unknown"} · ${message.topic || "global"}`;
  const body = String(message.body || "").trim();
  const priority = scoreRoute(message) === "push_summary"
    ? "Owner-relevant SilicaClaw broadcast"
    : "Routine";
  return [
    `Source: ${source}`,
    `Priority: ${priority}`,
    `What happened: ${body.slice(0, 240)}${body.length > 240 ? "..." : ""}`,
    "Action: Review whether owner follow-up or approval is needed.",
  ].join("\n");
}

The corresponding security requirement appears in references/push-routing-policy.md, lines 41-43:

md

## Safety rules

- Never claim the original broadcast was private.
- Mention that the source was the public broadcast stream when context matters.
- Redact secrets before sending through OpenClaw's owner channel.

Technical Analysis

summarizeForOwner() copies the first 240 characters of an untrusted public broadcast directly into the owner-facing summary. It performs no detection or redaction of passwords, authorization headers, access tokens, API keys, private-key material, connection strings, or similar sensitive values.

This behavior conflicts with the explicit routing-policy requirement to redact secrets before delivery. It is particularly relevant because credential is included in the default high-signal terms: a broadcast discussing or exposing credentials is therefore more likely to be selected for forwarding.

Truncation is not a security control. Many secrets are shorter than 240 characters and may appear near the beginning of a message.

Attack Path

1. A publisher places a secret or secret-like value within the f ...[truncated 1198 chars]

Remediation

View remediation

Remediation Suggestions

• Introduce a dedicated sanitization function and apply it before constructing or dispatching any owner-facing message.
• Detect and replace common secret formats, including authorization headers, passwords, API tokens, JWTs, cloud access keys, connection strings, private-key blocks, and configurable organization-specific patterns.
• Reject or heavily redact messages containing PEM private-key boundaries or other high-confidence credential material.
• Prefer structured summaries that describe the event without copying raw broadcast text.
• Limit source excerpts to the minimum needed after redaction; do not treat truncation as a substitute for sanitization.
• Provide an explicit, audited opt-in for raw forwarding and still apply mandatory secret redaction unless a separately authorized secure workflow requires exact content.
• Add tests covering secrets at the beginning, middle, and truncation boundary of messages, including multiple secrets in one broadcast.
• Avoid logging the original broadcast body or failed delivery payloads where secrets could be retained.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md

node scripts/owner-push-forwarder.mjs

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

md

node scripts/owner-push-forwarder.mjs

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

md

node scripts/owner-push-forwarder.mjs

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

md

node scripts/owner-push-forwarder.mjs

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script executes a fully configurable command from the OPENCLAW_OWNER_FORWARD_CMD environment variable using spawn(..., { shell: true }). That gives whoever controls configuration or deployment the ability to run arbitrary shell commands with the forwarder's privileges, which exceeds the narrow advertised purpose of forwarding owner summaries and creates a command-execution sink around potentially sensitive message data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the agent to use network access, environment variables, and local command execution, but it does not declare an explicit tool scope or permission boundary in the skill metadata. That increases the chance the runtime grants broader capabilities than necessary, making unintended network polling or command execution easier if the skill is invoked in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The routing rules use very broad phrases like 'watch for me' and 'tell me when something important happens,' which can match ordinary conversation and trigger this monitoring skill unintentionally. Because the skill can start persistent monitoring and owner-directed forwarding, accidental invocation could enable ongoing data flow or notifications the user did not clearly authorize.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The 'use this skill immediately' guidance includes ambiguous requests such as 'monitor the network' and 'notify me when something important happens' without requiring domain-specific confirmation. In a multi-skill environment, this can cause the wrong skill to activate and begin persistent polling/forwarding behavior beyond the user's actual intent.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

It will not:

- execute arbitrary code from broadcasts or forwarded content
- access unknown remote endpoints or hidden delivery routes
- manage wallets, private keys, or blockchain signing
- silently widen monitoring or forwarding beyond the owner's requested scope

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The title and description state that this cheat sheet is for handling owner dialogue in Chinese and present only Chinese-language trigger interpretations. There is no indication that the user can opt into another language or that the locale restriction is required for a region-specific purpose, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger examples for starting continuous monitoring are broad everyday phrases such as '帮我盯着广播' and '有变化就提醒我', which can plausibly appear in ordinary conversation without a clear consent boundary for enabling persistent monitoring and outbound pushing. In this skill context, accidental activation is more dangerous than in a passive assistant because the capability initiates ongoing surveillance of public broadcasts and automatic delivery through another channel, creating privacy, notification, and autonomy risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The stop phrases include ambiguous language like '先别提醒我了' and '关闭监控', which may match temporary conversational pauses rather than a clearly scoped request to disable this specific monitoring workflow. While safer than accidental enablement, ambiguous deactivation can still cause state confusion, either stopping an important monitoring pipeline unexpectedly or leaving users unsure whether pushing has actually ceased.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script polls an API endpoint and retrieves message bodies, display names, and topics, then later forwards those messages for owner review. The default API base is plain HTTP on localhost and there is no user-facing warning, prompt, or explanatory comment disclosing that message content is being transmitted over the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script executes an arbitrary command from the OPENCLAW_OWNER_FORWARD_CMD environment variable using shell mode and passes message data to it on stdin. There is no confirmation prompt, warning log, or explanatory comment near this behavior, so operators may not realize the skill will invoke external shell commands with message content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script allows the executed messaging binary to be fully controlled by environment variables via OPENCLAW_BIN or indirectly via OPENCLAW_SOURCE_DIR. In a skill that is only supposed to forward summaries to OpenClaw, this creates an unnecessary command-execution surface: anyone who can influence the environment can cause arbitrary local code to run with the skill's privileges when the push action triggers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script forwards payload.summary directly to an external messaging command, which causes data to leave the current process boundary and be delivered to a social or messaging channel. In this skill's context, exfiltration is part of the intended behavior, but the lack of any validation, classification, or explicit disclosure means sensitive or attacker-influenced content could be pushed outward automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The script persistently writes state to a file under the user's home directory and removes a lock file during cleanup. Aside from optional verbose logging of paths later in execution, there is no always-visible disclosure or inline explanation near these file-system side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script requires and uses environment variables for owner channel, target, and optional account, which are sensitive communication-routing values. Although this is functionally necessary, the file provides no user-facing notice or explanatory comment that these environment settings will be consumed to direct outbound messages.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/owner-push-forwarder.mjs:245

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/send-to-owner-via-openclaw.mjs:58

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/owner-push-forwarder.mjs:8