openclaw-cleaner

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:52 PM UTC
• Version: 1.0.0

Overview

This cleaner has useful project-maintenance features, but it can broadly copy and rewrite sensitive workspace and agent-state files without clear user confirmation or path containment.

Review before installing. Use only in workspaces where copying full file contents into .cleaner-backups is acceptable, avoid running it around secrets or private agent memory, and require manual review before backup.restore, optimize.soul, or optimize.full. The inspected artifact does not show network exfiltration or install-time backdoors, but its local read/write authority is broad and under-controlled.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:94

Finding

Unrestricted Collection and Duplication of Sensitive Workspace and Agent State

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:309

Finding

Path Traversal Enables Unauthorized File Access and Agent-State Replacement

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:421

Finding

Core Agent Memory and Instruction Files Are Modified Without Explicit Approval

Content

View full analysis

0) { await fs.writeFile(filePath, optimized); results.push({ file, saved, originalSize, optimizedSize: optimized.length }); } } catch { results.push({ file, saved: 0 }); } } return results; } optimizeContent(content) { return content.replace(/\n{3,}/g, '\n\n').replace(/[ \t]+\n/g, '\n').trim(); } } ``` ```javascript export const optimize = { async soul() { const results = await new MDOptimizer(silentLogger).optimizeSoulFiles(getWorkspacePath()); const totalSaved = results.reduce((sum, r) => sum + r.saved, 0); return { results, totalSaved }; }, async full() { const backupResult = await new BackupService(getWorkspacePath(), { logger: silentLogger }).create('auto-optimize'); await new MDOptimizer(silentLogger).optimizeSoulFiles(getWorkspacePath()); return { success: true, backup: backupResult.name }; }, }; ``` ### Technical Analysis The optimizer ope ...[truncated 1966 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: "00000000000000000000000000000000"
    PropagateID: "00000000000000000000000000000000"
    ReservedCode1: 3044022008f95be176b259fbfb3a949f6958e0b396669a2c888cbc014dd2f4e530fa797a0220104bffedadebe9ed4b19e63d59a7080a0281cae9b97979dcadec6da9e511d9c6
    ReservedCode2: 3046022100b77338c69c1afc4517c82ecb004c8d63b1c4ef4f1d01fbaa78d660eb34fb5a29022100cf452e1faf2d576f12f0395e1b1853cf3800e63f52c485123bc93fd1cf37c17b
description: OpenClaw清理大师 - 项目目录清理与优化工具。提供快照、Diff、检查点、任务进度等能力，AI 可直接调用自动执行。
name: openclaw-cleaner
tags:
    - openclaw
    - cleaner
    - optimization
    - snapshot
    - backup
version: 2.1.2
---

# 🧹

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly says AI may directly perform cleanup operations without user confirmation, while the code includes file-writing, backup, restore, and optimization operations over the workspace. In an autonomous-agent context, removing confirmation for state-changing actions substantially increases the chance of unauthorized or unintended modification of important files.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

---

javascript

// ============================================================================
// OpenClaw Cleaner - 完整实现代码 (2.1.2)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest presents the skill as a cleaning/optimization tool, but the implementation can back up and restore broader workspace state including agent and memory-related files and directories. This scope mismatch is dangerous because an AI or user may authorize routine cleanup while unintentionally granting write access to sensitive project state outside the advertised function.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description and user-facing instructions are written entirely in Chinese and present the skill as generally applicable, but there is no indication that language choice is optional or that the skill is intended only for a Chinese-language environment. This can violate a language/locale policy when a skill implicitly constrains interaction language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The optimization feature is described as benign maintenance, but the implementation rewrites important markdown files such as MEMORY.md, USER.md, SOUL.md, AGENTS.md, and TOOLS.md. Because these files may contain operational instructions or persistent state, silent rewriting can corrupt agent behavior, erase context, or alter trusted records.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The example at L045-L57 shows deleting a skill and then diffing the resulting filesystem changes, implying real removal side effects. In code, skills.remove simply returns { removed: name } without modifying the filesystem (L481), so the documentation actively misrepresents the effect of the operation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 500)May include surrounding context.

安装测试

bash

node skills/openclaw-cleaner/SKILL.md

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation advertises 'Skill Match' at L038 as a capability of this cleaner, and the code implements query classification in SkillMatcher (L403-L411) exposed via skills.match (L478-L480). Recommending related skills is semantically separate from project directory cleaning, snapshots, diffs, checkpoints, and optimization, and the manifest description does not justify this assistant-routing function.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented return shape for snapshot.compare at L85-L90 says modified entries contain a changes array. The implementation instead returns oldContent and newContent for modified files and does not populate any changes field (L182), so the documentation is inaccurate about the actual output contract.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.