Security audit

Alibaba Cloud Platform OpenClaw Setup

Security checks across malware telemetry and agentic risk

Overview

This setup skill is understandable, but it gives an agent broad authority to install software, store chat-service credentials, and start a persistent OpenClaw gateway on a Linux host.

Install only on a host you control. Review and pin every install command before running it, avoid running the gateway or agent workspace as root, restrict channel access with pairing or allowlists, protect app secrets and bot tokens with file permissions or a secret manager, and confirm how to stop or disable the gateway service before enabling production chat access.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The workflow claims the operator should begin with a minimal read-only verification, but the actual prescribed sequence performs package installation, plugin installation, config writes, and service startup before any validation. This mismatch can mislead users into making unintended changes on production hosts without first confirming target, permissions, or environment safety.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The guide instructs operators to retrieve highly sensitive credentials such as ClientSecret/AppSecret but provides no guidance on secure handling, least-privilege access, redaction, or secret storage. In an installation skill intended for Linux host provisioning and standardized configuration, this omission materially increases the chance that secrets are copied into plaintext configs, shell history, logs, screenshots, or source control.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The configuration mapping tells users exactly where to place AppSecret and gateway tokens in OpenClaw configuration but omits any warning that these values are secrets requiring protected storage. Because this skill is for standardizing `openclaw.json` mappings during setup and troubleshooting, users are especially likely to place long-lived secrets in plaintext config files that may be readable by other users, backups, support bundles, or version control.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide tells users to copy and place the Feishu `App Secret` into configuration, including a JSON example with a plaintext secret placeholder, but provides no warning about treating the value as a sensitive credential or using protected secret storage. In a setup guide for a production messaging integration, this omission can lead to secrets being stored in world-readable files, shell history, screenshots, tickets, or version control, enabling unauthorized bot control or API abuse if exposed.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.