QClaw Config Guardian

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:59 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent backup purpose, but it can persist sensitive QClaw/OpenClaw configuration and cron data in plaintext with broad automatic triggers and weak local-file safeguards.

Review this before installing if your QClaw/OpenClaw channels, plugins, or cron jobs may contain tokens, webhook URLs, private prompts, account IDs, or delivery targets. Only run backups intentionally, secure the backup directory to owner-only access, avoid the documented fixed /tmp cron-data file, and delete old backups you no longer need.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/backup_config.py:192

Finding

Backups containing potentially sensitive configuration are created without restrictive permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34

Finding

Predictable shared temporary file is used for cron-job configuration

Content

View full analysis

2: cron_data_path = sys.argv[2] cron_file = Path(cron_data_path) if cron_file.exists(): global_cron_data = json.loads(cron_file.read_text()) backup_config(cron_jobs_override=global_cron_data) else: sys.exit(1) else: backup_config() return ``` ### Technical Analysis `/tmp/cron_jobs.json` is a predictable filename in a directory normally shared by all local users. The documented process does not require exclusive creation, owner-only permissions, ownership validation, regular-file validation, symbolic-link protection, or deletion after use. Cron-job data may contain private task prompts, command arguments, delivery destinations, account identifiers, and scheduling metadata. If the Agent creates the file with permissive permissions, another local user may read it. Because the script checks only whether the path exists before parsing it, an attacker may also pre-create or replace the path and cause attacker-controlled JSON to be incorporated into the resulting backup. The observed data is parsed as JSON and stored in a backup; it is not executed as code. Consequently, the confirmed direct risks are confidentiality loss and backup-integrity corruption rather than arbitrary command execution. ### Attack Path #### Confidentiality attack 1. An attacker with local access monitors the predictable `/tmp/cron_jobs.json` path. 2. The Agent writes current cron-job ...[truncated 1517 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases include generic terms such as '版本升级' and '任务失败' that can easily appear in ordinary conversation, increasing the chance that the skill activates unintentionally. In this skill, unintended activation is more dangerous because activation can lead to reads of cron state, local configuration inspection, and creation of persistent backups without a clearly scoped user request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly describes automatic backup behavior that writes configuration and cron task data to disk, including copying backups into a persistent backup directory, but it does not clearly warn the user or require confirmation before persisting potentially sensitive operational data. This creates a privacy and security risk because cron definitions, channel mappings, and related configuration may contain identifiers, endpoints, or other sensitive metadata that remain on disk longer than the user expects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language descriptions and usage text are presented only in Chinese, which imposes a language choice on users without any opt-in or explanation of a region-specific requirement. Under the policy, language constraints should either be optional or clearly justified.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/backup_config.py (reported line 28)May include surrounding context.

python

if system == "Darwin":  # macOS
        try:
            result = subprocess.run(
                ["/usr/libexec/PlistBuddy", "-c", "Print CFBundleShortVersionString",
                 "/Applications/QClaw.app/Contents/Info.plist"],
                capture_output=True, text=True, timeout=5

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

if system == "Darwin":  # macOS
        try:
            result = subprocess.run(
                ["/usr/libexec/PlistBuddy", "-c", "Print CFBundleShortVersionString",
                 "/Applications/QClaw.app/Contents/Info.plist"],
                capture_output=True, text=True, timeout=5
            )

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/backup_config.py (reported line 29)May include surrounding context.

python

if system == "Darwin":  # macOS
        try:
            result = subprocess.run(
                ["/usr/libexec/PlistBuddy", "-c", "Print CFBundleShortVersionString",
                 "/Applications/QClaw.app/Contents/Info.plist"],
                capture_output=True, text=True, timeout=5
            )

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/backup_config.py (reported line 30)May include surrounding context.

python

try:
            result = subprocess.run(
                ["/usr/libexec/PlistBuddy", "-c", "Print CFBundleShortVersionString",
                 "/Applications/QClaw.app/Contents/Info.plist"],
                capture_output=True, text=True, timeout=5
            )
            if result.returncode == 0:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script serializes application configuration, plugin settings, channel settings, and cron job data into backup.json and latest.json on disk without any access-control hardening, encryption, redaction, or explicit sensitivity warning. If these configs contain API keys, tokens, server URLs, secrets, or operational details, other local users, malware, or backup/sync tooling could exfiltrate them.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module documentation says the tool performs '自动修复' and the '--fix' usage line labels it as automatic repair. In practice, the '--fix' branch only runs health checks, prints suggestions, invokes backup_config(), and then tells the user to manually run 'openclaw cron update' commands; it does not actually apply the cron configuration fixes itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language instructions and status text exclusively in Chinese, beginning with the module docstring and continuing throughout the script. Under the language/locale policy rule, forcing a specific language without user opt-in is a policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.