Security audit

Topical Openclaw Setup

Security checks for vulnerabilities and agentic risk

Overview

This setup skill is coherent, but it installs and executes unpinned companion code that can persist inside the OpenClaw gateway path.

Install only if you trust both this setup skill and the companion @daveangelcode/topical package. Prefer a pinned or reviewed companion version, inspect the transform before copying it into ~/.openclaw/hooks/transforms, do not expose Agent API keys or hooks.token, and keep a backup of ~/.openclaw/openclaw.json before running the setup.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:104
Finding: Unpinned External Skill Installation Allows Mutable Supply-Chain Code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/copy-transforms.sh:5
Finding: Environment-Controlled Transform Installer Executes an Arbitrary Local Program
Content: View full analysis
&2 echo "If installed from ClawHub, topical assets ship inside @daveangelcode/topical — set TOPICAL_SKILL_DIR." >&2 exit 1 fi exec "${COPY_SCRIPT}" ``` ### Technical Analysis The script trusts the externally supplied `TOPICAL_SKILL_DIR` environment variable and constructs an executable path from it. The only validation is whether the resulting file has its executable bit set. No canonical-path restriction, ownership check, integrity verification, signature validation, or approved-directory allowlist is applied before `exec`. An attacker who can influence the process environment and create an executable at the selected path can cause arbitrary code to run. Quoting prevents shell metacharacter injection, but it does not prevent executable-path substitution. This entry point is particularly sensitive because its intended operation installs gateway transform modules into a persistent OpenClaw directory. ### Attack Path 1. The attacker creates a directory containing a malicious executable at `scripts/copy-transforms.sh`. 2. The attacker marks the file executable. 3. The attacker causes the setup process to run with `TOPICAL_SKILL_DIR` pointing to that directory. 4. The wrapper confirms only that the file is executable. 5. `exec "${COPY_SCRIPT}"` replaces the wrapper process with the attacker-controlled program. 6. The program runs with the privileges of the account performing the OpenClaw setup. ### Impact Assessment Successful exploitation ...[truncated 344 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/verify-migration.sh:4
Finding: Environment-Controlled Verification Script Allows Arbitrary Code Execution
Content: View full analysis
&2 exit 1 fi exec "${VERIFY_SCRIPT}" ``` ### Technical Analysis The migration verifier delegates execution to a program chosen through the `TOPICAL_SKILL_DIR` environment variable. The executable-bit test confirms neither the identity nor trustworthiness of that program. An attacker-controlled directory can therefore substitute an arbitrary `scripts/verify.sh`. Users may treat a verification command as read-only and safe, making this delegation especially misleading. Although shell argument injection is prevented by quoting, the selected executable itself remains attacker-controlled. ### Attack Path 1. An attacker prepares a directory containing a malicious executable named `scripts/verify.sh`. 2. The attacker influences the environment so that `TOPICAL_SKILL_DIR` references the prepared directory. 3. The user follows Step 6 of the setup instructions and invokes `verify-migration.sh`. 4. The wrapper checks that the attacker-controlled file is executable. 5. The wrapper executes the malicious file without validating its origin or integrity. 6. Arbitrary commands run as the user who operates OpenClaw. ### Impact Assessment The attacker obtains code execution with the invoking user's privileges and access to that user's OpenClaw configuration, API credentials, webhook tokens, and writable files. The payload could falsify verification results, modify gateway state, replace transforms, or create persistence available to later OpenClaw sessions. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill’s stated purpose is Topical/OpenClaw integration, but it also instructs the agent to execute auxiliary scripts from a sibling skill/repo path (copy-transforms.sh, verify-migration.sh). That expands the trust boundary to external code not fully described in the metadata, creating supply-chain and unexpected-execution risk if those scripts are modified or malicious.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
Or manually:

bash
mkdir -p ~/.openclaw/hooks/transforms cp <topical-skill>/assets/topical-inbound.mjs ~/.openclaw/hooks/transforms/ cp <topical-skill>/assets/topical.config.example.json ~/.openclaw/hooks/transforms/topical.config.json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.
Optional live probe (requires public URL):

bash
curl -sS -X POST "https://<PUBLIC_GATEWAY_HOST>/hooks/topical-inbound" \ -H "Authorization: Bearer <hooks.token>" \ -H "Content-Type: application/json" \ -d '{"type":"topic_breaking_news","topicId":"test","breakingNewsId":"probe","title":"Setup probe","summary":"Ignore","relevanceScore":0,"sources":[],"deliveredAt":"2026-01-01T00:00:00.000Z"}'

Static analysis

No suspicious patterns detected.