OpenClaw Setup Wizard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:10 AM UTC
• Version: 1.0.0

Overview

This OpenClaw setup skill is mostly coherent, but it includes powerful troubleshooting and recovery instructions that can change or disrupt a user's local environment without enough safeguards.

Install only if you are comfortable with an OpenClaw administration skill that runs local diagnostics and suggests environment-changing commands. Review commands before executing them, avoid the force-kill and reset/restore steps unless you have backups and have confirmed the target process or files, protect all bot/API tokens as secrets, and prefer a pinned OpenClaw reinstall version from a trusted registry.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/troubleshooting.md:8

Finding

Unpinned Global Package Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: references/troubleshooting.md, lines 8-12
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

bash

### Gateway crashes repeatedly
- Check logs: `openclaw gateway logs`
- Verify Node.js version: `node --version` (need v20+)
- Check LaunchAgent: `launchctl list | grep openclaw`
- Reinstall: `npm install -g openclaw`

Technical Analysis

The troubleshooting instructions recommend installing openclaw globally from the configured npm registry without specifying a reviewed version or verifying package integrity. The effective code installed by this command can therefore change after the Skill has been audited.

npm packages may contain lifecycle scripts that execute during installation. If the registry package, maintainer account, dependency tree, or local npm registry configuration is compromised, following this instruction could execute attacker-controlled code. The risk is increased by global installation because the package exposes commands across the user's environment and modifies a shared package location.

The command does not explicitly use sudo, so execution is ordinarily limited to the privileges of the user running npm. If a user independently prefixes it with sudo or uses a privileged npm environment, package lifecycle code could run with elevated privileges.

Attack Path

1. An attacker compromises the published openclaw package, one of its dependencies, a maintainer account, or a registry endpoint used by the victim.
2. A malicious package version or dependency is published under the expected package name.
3. The victim experiences repeated gateway crashes and follows the documented reinstall instruction.
4. npm install -g openclaw resolves the current package version rather than a specifically reviewed release.
5. npm downloads the compromised content and may execute its lifecycle sc ...[truncated 777 chars]

Remediation

View remediation

Remediation Suggestions

• Pin installation instructions to a specifically reviewed release, for example:

  bash

  npm install -g openclaw@REVIEWED_VERSION
  

• Document the expected official npm package name, publisher, and registry URL.

• Verify the package version and integrity before installation. Where practical, distribute and validate signed release artifacts or documented checksums.

• Review the package's lifecycle scripts and dependency tree before recommending a release.

• Avoid running global package installations through sudo; install with the minimum privileges required.

• Prefer a reproducible installation mechanism using a lockfile or an equivalent integrity-controlled dependency manifest.

• Consider first offering a repair or rollback procedure that does not automatically resolve mutable package content.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/troubleshooting.md:3

Finding

Troubleshooting Command Force-Kills Unverified Processes on Port 3000

Content

View full analysis

Vulnerability Details

File Location: references/troubleshooting.md, lines 3-7
Vulnerability Type: Unsafe process termination command
Risk Level: Medium

Vulnerable Code

bash

### Gateway won't start
```bash
openclaw gateway status          # Check current state
openclaw gateway restart         # Force restart
lsof -ti:3000 | xargs kill -9   # Kill port conflicts

text

### Technical Analysis

The command obtains every process identifier associated with port 3000 and immediately sends each process `SIGKILL`. It does not verify that a selected process belongs to OpenClaw, is owned by the current user, or is safe to terminate.

Port ownership is not a reliable process identity check. An unrelated development server, application, or infrastructure service may legitimately use port 3000. Moreover, `SIGKILL` prevents the target from performing cleanup, flushing buffered data, releasing application resources gracefully, or preserving consistent state.

The command is not an inherent privilege-escalation primitive: `kill` remains subject to operating-system authorization. It can nevertheless terminate any matching process that the invoking user is authorized to signal. If the user runs the command from an elevated shell, that scope may include system services and processes owned by other users.

### Attack Path

1. An unrelated application or service listens on port 3000.
2. The OpenClaw gateway fails to start, or the user otherwise follows the gateway troubleshooting section.
3. The user runs `lsof -ti:3000 | xargs kill -9`.
4. `lsof` returns all process identifiers associated with that port without validating their executable identity.
5. `xargs` passes those identifiers to `kill -9`.
6. Every process the user is authorized to signal is terminated immediately, including unrelated services.
7. Abrupt termination may interrupt active requests or leave application data in an inconsistent state.


...[truncated 580 chars]

Remediation

View remediation

Remediation Suggestions

• First display the process and require the user to verify its identity:

  bash

  lsof -nP -iTCP:3000 -sTCP:LISTEN
  

• Prefer stopping the gateway through its supported management command:

  bash

  openclaw gateway stop
  

• If manual termination is necessary, capture one PID, inspect its executable and owner, and require confirmation before signaling it.

• Send SIGTERM first so the process can shut down cleanly. Use SIGKILL only after a timeout and a second explicit confirmation.

• Do not recommend running the process-termination procedure with sudo.

• Validate that the selected process is actually the expected OpenClaw gateway before terminating it.

• Replace the one-line force-kill instruction with a guarded procedure that refuses to act when multiple or unexpected processes are detected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is presented as a full setup, configuration, optimization, and hardening wizard, but the content mainly instructs running diagnostics and references other files rather than implementing the promised safeguards and guided behavior. This mismatch is dangerous because users may over-trust the skill to perform security-sensitive setup or hardening steps that are not actually enforced, leaving systems misconfigured or insecure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill directs the agent to run shell commands (bash scripts/diagnose.sh, scripts/harden.sh) but does not declare any tool scope or allowed-tools constraints. This is dangerous because it creates undeclared execution capability, making it easier for a skill to trigger local command execution without explicit permission boundaries or user awareness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description uses very broad invocation language covering setup, troubleshooting, hardening, backups, providers, channels, and skill installation. This is dangerous because overly broad trigger wording can cause the skill to be selected in many common requests, increasing the chance of unnecessary shell execution guidance or the application of an over-privileged skill in unrelated contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file instructs users to copy and paste a Telegram bot token into configuration, but it does not warn that the token is a sensitive credential that must be kept secret and not shared or committed. Under the markdown-specific warning rule, omitting privacy/security cautions for credential-handling behavior is a meaningful user-warning gap.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions tell the user to enable MESSAGE CONTENT INTENT and obtain bot/app tokens, which affects message privacy and introduces sensitive credentials. The file does not disclose either the privacy implications of message-content access or the need to protect those tokens, so the description lacks an important user warning.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/channels.md (reported line 45)May include surrounding context.

md

## Slack

1. Create app at https://api.slack.com/apps
2. Enable Socket Mode
3. Get bot token (`xoxb-...`) and app token (`xapp-...`)
4. Configure both tokens via `openclaw configure`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown directs users to retrieve xoxb-... and xapp-... tokens and configure them, but gives no warning that these values are credentials that can grant channel or app access if leaked. Because this file describes behavior affecting privacy and system integrity, the omission qualifies as a missing user warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The troubleshooting steps include forceful process termination with kill -9 to clear port conflicts, but they do not warn the user that this can abruptly terminate unrelated processes bound to port 3000 and cause data loss or service disruption. In an interactive setup/troubleshooting skill, users may copy-paste commands directly, so the lack of impact guidance makes accidental destructive use more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 28)May include surrounding context.

md

### Model not responding
- Check fallback: `openclaw models fallbacks list`
- Try different model: `openclaw models set <alternative>`
- Test connectivity: `curl -s https://api.openai.com/v1/models`

### Rate limiting
- Add fallback models to auto-switch

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The backup restore instructions extract an archive directly into the OpenClaw workspace without warning that existing files may be overwritten or that restoration should be validated before use. In a setup wizard context, recovery commands are likely to be followed by non-expert users, increasing the chance of unintended data loss or state corruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The openclaw configure --reset command is presented as a fix for corrupted config without explicitly stating that it resets configuration to defaults and may remove provider, channel, or security-related settings. Because this skill is meant to guide setup and remediation, users may execute it without understanding the resulting loss of configuration and service availability impact.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/harden.sh (reported line 20)May include surrounding context.

sh

if [ -f "$f" ]; then
        PERMS=$(stat -f "%Lp" "$f" 2>/dev/null || stat -c "%a" "$f" 2>/dev/null)
        if [ "$PERMS" != "600" ]; then
            chmod 600 "$f"
            echo -e "  ${GREEN}✅ Fixed${NC}: $f (was $PERMS → 600)"
            fixed=$((fixed + 1))
        else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/harden.sh (reported line 53)May include surrounding context.

sh

if [ -d "$WS" ]; then
    WS_PERMS=$(stat -f "%Lp" "$WS" 2>/dev/null || stat -c "%a" "$WS" 2>/dev/null)
    if [ "$WS_PERMS" != "700" ] && [ "$WS_PERMS" != "755" ]; then
        chmod 700 "$WS"
        echo -e "  ${GREEN}✅ Fixed${NC}: workspace (was $WS_PERMS → 700)"
        fixed=$((fixed + 1))
    else

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/diagnose.sh (reported line 213)May include surrounding context.

sh

# 6. Auto-start resilience
echo ""
echo "6. Auto-start configuration"
PLIST="$HOME/Library/LaunchAgents/com.openclaw.gateway.plist"
if [ -f "$PLIST" ]; then
    ISSUES=""
    grep -q "RunAtLoad.*true" "$PLIST" || ISSUES="${ISSUES}RunAtLoad "

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/diagnose.sh (reported line 214)May include surrounding context.

sh

# 6. Auto-start resilience
echo ""
echo "6. Auto-start configuration"
PLIST="$HOME/Library/LaunchAgents/com.openclaw.gateway.plist"
if [ -f "$PLIST" ]; then
    ISSUES=""
    grep -q "RunAtLoad.*true" "$PLIST" || ISSUES="${ISSUES}RunAtLoad "

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/diagnose.sh (reported line 216)May include surrounding context.

sh

# 6. Auto-start resilience
echo ""
echo "6. Auto-start configuration"
PLIST="$HOME/Library/LaunchAgents/com.openclaw.gateway.plist"
if [ -f "$PLIST" ]; then
    ISSUES=""
    grep -q "RunAtLoad.*true" "$PLIST" || ISSUES="${ISSUES}RunAtLoad "

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/diagnose.sh (reported line 221)May include surrounding context.

sh

# 6. Auto-start resilience
echo ""
echo "6. Auto-start configuration"
PLIST="$HOME/Library/LaunchAgents/com.openclaw.gateway.plist"
if [ -f "$PLIST" ]; then
    ISSUES=""
    grep -q "RunAtLoad.*true" "$PLIST" || ISSUES="${ISSUES}RunAtLoad "

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/harden.sh (reported line 104)May include surrounding context.

sh

# 6. Auto-start resilience
echo ""
echo "6. Auto-start configuration"
PLIST="$HOME/Library/LaunchAgents/com.openclaw.gateway.plist"
if [ -f "$PLIST" ]; then
    ISSUES=""
    grep -q "RunAtLoad.*true" "$PLIST" || ISSUES="${ISSUES}RunAtLoad "

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/harden.sh (reported line 105)May include surrounding context.

sh

# 6. Auto-start resilience
echo ""
echo "6. Auto-start configuration"
PLIST="$HOME/Library/LaunchAgents/com.openclaw.gateway.plist"
if [ -f "$PLIST" ]; then
    ISSUES=""
    grep -q "RunAtLoad.*true" "$PLIST" || ISSUES="${ISSUES}RunAtLoad "

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/harden.sh (reported line 107)May include surrounding context.

sh

# 6. Auto-start resilience
echo ""
echo "6. Auto-start configuration"
PLIST="$HOME/Library/LaunchAgents/com.openclaw.gateway.plist"
if [ -f "$PLIST" ]; then
    ISSUES=""
    grep -q "RunAtLoad.*true" "$PLIST" || ISSUES="${ISSUES}RunAtLoad "

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/harden.sh (reported line 108)May include surrounding context.

sh

# 6. Auto-start resilience
echo ""
echo "6. Auto-start configuration"
PLIST="$HOME/Library/LaunchAgents/com.openclaw.gateway.plist"
if [ -f "$PLIST" ]; then
    ISSUES=""
    grep -q "RunAtLoad.*true" "$PLIST" || ISSUES="${ISSUES}RunAtLoad "

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/harden.sh (reported line 113)May include surrounding context.

sh

# 6. Auto-start resilience
echo ""
echo "6. Auto-start configuration"
PLIST="$HOME/Library/LaunchAgents/com.openclaw.gateway.plist"
if [ -f "$PLIST" ]; then
    ISSUES=""
    grep -q "RunAtLoad.*true" "$PLIST" || ISSUES="${ISSUES}RunAtLoad "

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/diagnose.sh (reported line 213)May include surrounding context.

sh

# 6. Auto-start resilience
echo ""
echo "6. Auto-start configuration"
PLIST="$HOME/Library/LaunchAgents/com.openclaw.gateway.plist"
if [ -f "$PLIST" ]; then
    ISSUES=""
    grep -q "RunAtLoad.*true" "$PLIST" || ISSUES="${ISSUES}RunAtLoad "

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/harden.sh (reported line 104)May include surrounding context.

sh

# 6. Auto-start resilience
echo ""
echo "6. Auto-start configuration"
PLIST="$HOME/Library/LaunchAgents/com.openclaw.gateway.plist"
if [ -f "$PLIST" ]; then
    ISSUES=""
    grep -q "RunAtLoad.*true" "$PLIST" || ISSUES="${ISSUES}RunAtLoad "

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/harden.sh (reported line 128)May include surrounding context.

sh

if [ "$SLEEP" = "0" ]; then
        echo -e "  ${GREEN}✅ OK${NC}: Sleep disabled"
    else
        echo -e "  ${YELLOW}⚠️${NC}: Sleep = $SLEEP (recommend: sudo pmset -a sleep 0 disksleep 0)"
        skipped=$((skipped + 1))
    fi
fi