Security audit

OpenClaw Growth Pack

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent with OpenClaw setup, but it asks for persistent agent behavior, scheduled jobs, and plaintext token printing without enough safeguards.

Review before installing. The OpenClaw configuration guidance is generally aligned with the stated setup purpose, but you should avoid running the token audit as written, require explicit approval before any AGENTS.md, HEARTBEAT.md, cron, or memory-rule changes, and ensure any scheduled work has a clear command, limited scope, expiration, logs without secrets, and removal steps.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:60
Finding: Persistent Modification of Agent Instructions and Long-Term Memory
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:74
Finding: Automatic Creation of Cross-Session Scheduled Jobs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:39
Finding: Gateway Authentication Tokens Printed in Plaintext
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: references/examples.md:40
Finding: Persistent Local Rules Generated from Untrusted Memory Content
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.
md
--- name: openclaw-growth-pack description: Turn a fresh OpenClaw install into a reliable execution agent. Use when users report "asks step-by-step only", stalls mid-task, token mismatch, or model routing/auth failures. Apply a production onboarding baseline: model routing, gateway token consistency, anti-stall heartbeat, lightweight autonomy loop, and verification checklist. ---

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/examples.md (reported line 6)May include surrounding context.
md
## Example A: Fix 401 after valid key Symptoms: - `HTTP 401: invalid access token or token expired` - key is valid in provider console Checks:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs operators to read and print gateway.auth.token and gateway.remote.token directly to console, which unnecessarily exposes secrets in terminal output, logs, screenshots, or shared session recordings. Even though this is framed as troubleshooting, the workflow lacks masking, redaction guidance, or safer comparison methods, so it creates a real credential-handling weakness.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.