ClawHub
Back to skill

Security audit

Agent Optimize

Security checks for vulnerabilities and agentic risk

Overview

This is a plausible OpenClaw performance diagnostic skill, but it asks users to read and potentially modify sensitive local agent state with weak boundaries.

Review before installing. Run it manually in report-only mode, do not enable auto-fix or cron examples until you inspect the exact commands, and avoid sharing generated reports or /tmp backups because they may expose session, memory, path, or config details.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill is presented as a diagnostic/audit tool, but the documentation also promotes auto-fix actions such as cleanup, archiving, disabling skills, and modifying configuration. This broadens operator expectations and can lead users to authorize state-changing behavior under the safer-sounding guise of diagnostics, increasing the chance of unintended destructive actions.

Scope Creep

High
Confidence
98% confidence
Finding
The skill documents auto-fix, backup, chmod, archive, and cleanup workflows that require write/delete capabilities, yet the manifest explicitly denies write access. This mismatch is dangerous because it obscures the true operational risk: users may trust the declared restrictions while following instructions that alter files, permissions, sessions, or configs outside the stated capability boundary.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill goes beyond one-time diagnostics by recommending cron-based scheduled execution and continuous monitoring setup. Persisting itself into ongoing automation materially increases blast radius because a mistaken or later-expanded remediation path could repeatedly affect sessions, files, or configuration without fresh review.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill reads the workspace .env file and parses every key/value pair to detect duplicate configuration keys. .env files commonly contain API keys, tokens, and credentials, so this diagnostic behavior exceeds what is necessary for optimization analysis and creates direct credential-access risk if the data is later logged, reported, or mishandled.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# 優化前自動備份
backup_dir="/tmp/agent-optimize-backup-$(date +%Y%m%d-%H%M%S)"
mkdir -p "$backup_dir"
cp -r ~/.openclaw/workspace/*/memory "$backup_dir/"
cp -r ~/.openclaw/sessions "$backup_dir/"
```
Confidence
93% confidence
Finding
The backup workflow copies session and memory data into /tmp, creating additional persistent copies of potentially sensitive conversational and memory content. Because /tmp is a shared, transient location with weaker handling guarantees, this can expand exposure surface and leave recoverable artifacts beyond the original protected locations.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
src/index.js:44