Security audit

OpenClaw DLP Guard

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed prompt-injection guard whose risky-looking phrases are examples to detect, not instructions to run.

Install only if you want outbound automated posts, API submissions, web forms, and shared file writes to be checked before submission. Review the enabled platforms, timeout, reject-on-timeout, and full-content review behavior, especially if submitted content may contain secrets or personal data.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documentation inconsistently defines which platforms are protected: Telegram and Discord are absent from the supported-platforms section but enabled in state/config examples. This can cause operators or downstream implementations to mistakenly leave those channels unprotected, creating a coverage gap in a security control that is supposed to guard external submissions.

Intent-Code Divergence

Low

Confidence: 78% confidence
Finding: The skill describes mixed decision behavior: low severity findings can proceed, while other sections emphasize reject-by-default and auto-reject on timeout. This inconsistency can lead to unsafe operator assumptions or divergent implementations, potentially allowing suspicious content through when reviewers believe the guard is stricter.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger includes a broad condition covering automated tasks involving external submission, which may activate the guard for many unrelated workflows. Overly broad triggering in a security gate can produce alert fatigue, encourage bypass/disable behavior, and reduce trust in genuinely important detections.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The owner-review flow offers to show full content after initially providing a sanitized preview, but it does not warn about or constrain exposure of secrets, PII, or sensitive user data. That creates a direct confidentiality risk because the review path can become a mechanism for unnecessary data disclosure to the owner or any party with access to the review interface.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: README.md:103

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:43