openclaw-audit-watchdog

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:30 AM UTC
• Version: 0.1.9

Overview

The skill mostly does what it says, but its recurring background job, mutable update option, external report delivery, and inconsistent install verification need careful review before installation.

Install only after verifying the release artifact, reviewing the exact DM and email recipients, and deciding that a recurring unattended OpenClaw audit job is appropriate for this host. Leave PROMPTSEC_GIT_PULL disabled unless updates are handled by a trusted release process, avoid remote plaintext SMTP, and prefer an explicit one-time audit command when you do not want persistence.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/runner.sh:27

Finding

Mutable Git Updates Are Executed by the Recurring Audit Runner

Content

View full analysis

/dev/null 2>&1 && [[ -d "$ROOT_DIR/.git" ]]; then git -C "$ROOT_DIR" pull --ff-only >/dev/null 2>&1 || true fi fi ``` The retrieved working-tree content is subsequently executed: ```bash REPORT="$($SCRIPT_DIR/run_audit_and_format.sh "${args[@]}")" ``` ### Technical Analysis When `PROMPTSEC_GIT_PULL=1`, the scheduled runner performs `git pull --ff-only` against the repository's currently configured remote and branch. It does not pin an expected commit, verify a signed commit or tag, validate file hashes, or compare the update against a trusted release manifest. A fast-forward-only update prevents local history rewriting but does not establish authenticity. An attacker who can publish to the tracked branch, compromise the upstream account, alter repository DNS or credentials, or modify the local Git remote can replace executable files such as `run_audit_and_format.sh`, `render_report.mjs`, or the email-delivery scripts. The runner then executes files from the updated working tree during the same invocation. Suppressing the Git error with `|| true` also makes update failures less visible to operators. ### Attack Path 1. An operator enables `PROMPTSEC_GIT_PULL=1`. 2. The Skill runs through its unattended cron job. 3. An attacker compromises the tracked repository, branch, publisher account, or local remote configuration. 4. The attacker publishes a fast-forward commit containing modified executable scripts. 5. `git pull --ff-only` accepts the commit without cryptographic trust verification. 6. The runner invokes the newly retrieved `run_audit_and_format.sh`. 7. The malicious code executes with the filesystem, environment, network access, and OpenClaw credentials available to the schedu ...[truncated 526 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: scripts/setup_cron.mjs:278

Finding

Skill Creates an Unattended Persistent Agent Cron Job

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: README.md:8

Finding

Installation Paths Use Unpinned or Unverified Remote Artifacts

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send_smtp.mjs:17

Finding

SMTP Fallback Transmits Security Audit Reports Without Transport Encryption

Content

View full analysis

new Promise((resolve, reject) => { const onData = (chunk) => { buffer += chunk.toString("utf8"); const idx = buffer.indexOf("\r\n"); if (idx !== -1) { const line = buffer.slice(0, idx); buffer = buffer.slice(idx + 2); cleanup(); resolve(line); } }; const onError = (e) => { cleanup(); reject(e); }; const onTimeout = () => { cleanup(); reject(new Error("SMTP timeout")); }; const cleanup = () => { socket.off("data", onData); socket.off("error", onError); socket.off("timeout", onTimeout); }; socket.on("data", onData); socket.on("error", onError); socket.on("timeout", onTimeout); }); const write = (line) => socket.write(line + "\r\n"); try { const greet = await readLine(); expectCode(greet, ["220"]); write(`EHLO ${helo}`); while (true) { const l = await readLine(); if (l.startsWith("250-")) continue; expectCode(l, ["250"]); break; } write(`MAIL FROM:<${fromClean}>`); expectCode(await readLine(), ["250"]); write(`RCPT TO:<${toClean}>`); expectCode(await readLine(), ["250", "251"]); write("DATA"); expectCode(await readLine(), ["354"]); socket.write(msg + "\r\n.\r\n"); expectCode(await readLine(), ["250"]); ``` ### Technical Analysis The SMTP implementation opens a raw TCP connection using `node:net`. It does not use implicit TLS, issue `STARTTLS`, validate a relay certificate, or authenticate the relay. The default destination is loopback, which reduces exposure in the default configuration. However, ...[truncated 1248 chars]

Remediation

View remediation

other

Warning

• Location: CHANGELOG.md:47

Finding

Process-Execution Behavior Was Intentionally Renamed to Avoid Static Moderation Signatures

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises an automated daily auditing system with report delivery and cron management. The supplied code only resolves a Codex binary and runs a one-off read-only codex review command against the skill directory with a security-focused prompt. There is no evidence of scheduling, persistence, OpenClaw agent inspection, DM/email sending, or formatted recipient reporting. This is a material mismatch in primary purpose and capabilities, not merely an implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code chunk only executes security audits, collects JSON output, and passes results to a report-rendering script for stdout output. The declared description says the skill performs automated daily audits, creates or updates a recurring cron job, and sends formatted reports via DM and optional email to configured recipients. None of those delivery or scheduling capabilities are present in this code. While the auditing portion matches part of the description, the primary operational claims about automation, cron setup, and outbound report delivery are not represented by the supplied code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code aligns with much of the stated purpose: it runs a security audit, supports formatted output to stdout for cron/DM delivery, and optionally emails the report. However, the declared description explicitly says it 'creates or updates a recurring cron job,' and this code chunk contains no cron installation or scheduling logic at all. That is a material description/behavior mismatch. Additionally, the script can optionally run 'git pull' on the repository, which is an undeclared capability involving repository modification/network access, though it appears secondary to the main audit function.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied code chunk only implements email delivery via sendmail. It does not perform security audits, schedule recurring execution, manage cron jobs, or send DM reports. While email reporting is mentioned in the description, this file is just a narrow helper for that one aspect. Because the declared purpose describes a broader automation skill with auditing, scheduling, and DM delivery, and the actual code shown lacks those primary capabilities, the description does not accurately represent this code chunk on its own.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

For standalone installs, verify the signed release manifest before trusting `SKILL.md`, `skill.json`, or the archive. The `skill.json` file is the package metad

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

RELEASE_PUBKEY_SHA256="711424e4535f84093fefb024cd1ca4ec87439e53907b305b79a631d5befba9c8"

curl -fsSL "$BASE/checksums.json" -o "$TMP_DIR/checksums.json"
curl -fsSL "$BASE/checksums.sig" -o "$TMP_DIR/checksums.sig"
curl -fsSL "$BASE/signing-public.pem" -o "$TMP_DIR/signing-public.pem"
curl -fsSL "$BASE/$ZIP_NAME" -o "$TMP_DIR/$ZIP_NAME"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/codex_review.sh (reported line 22)May include surrounding context.

sh

# Use GPT-5.1 Codex Max (high reasoning). Note: some models (e.g. o3) may be blocked
# depending on the account type.
exec "$RESOLVED_CODEX_BIN" review -s read-only -m gpt-5.1-codex-max \
  "Review this skill for security/reliability issues. Focus on: shell quoting, command injection, sendmail header injection, dependency checks, cron payload safety, and failure modes. Provide concrete patch suggestions (with diffs if possible)." \
  -c "workdir=\"$ROOT_DIR\"" \
  -c "reasoning_effort=\"xhigh\""

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/render_report.mjs (reported line 96)May include surrounding context.

js

// Check if this finding matches any suppression rule
    const isSuppressed = suppressions.some((rule) => {
      return rule.checkId === checkId && normalizeSkillName(rule.skill) === normalizedSkillName;
    });

    if (isSuppressed) {

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

bash

# Install skill
mkdir -p ~/.openclaw/skills/openclaw-audit-watchdog
cd ~/.openclaw/skills/openclaw-audit-watchdog

# Download and extract

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx skills add ... without pinning a specific package version allows installation to depend on whatever version is current at execution time. That creates a supply-chain risk where a malicious or compromised upstream package release could change behavior or deliver unreviewed code to the host.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill explicitly creates or updates an unattended recurring cron job that will run security audits and send reports. Persistent scheduled execution increases attack surface because a misconfigured or compromised skill can continue running without user supervision, potentially leaking findings, secrets, host identifiers, or enabling ongoing unwanted activity.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md

## Goal

Create (or update) a daily cron job that:

1) Runs:
- `openclaw security audit --json`

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

md

→ Remediation: Run `openclaw security audit --fix` to update

[WARN-007] Weak Permission on Config File
→ Remediation: chmod 600 ~/.openclaw/config.json

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Run `openclaw security audit --deep` for full details.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · examples/README.md (reported line 59)May include surrounding context.

1. Copy the example config:

bash

mkdir -p ~/.openclaw
cp security-audit-config.example.json ~/.openclaw/security-audit.json

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The inline documentation frames the operation as read-only and safe by default, but the actual command executes an external AI review tool whose behavior is not limited to local file reads in the ordinary sense. While the '-s read-only' flag may constrain filesystem writes, the script still launches a capability beyond what the comment implies, so the documentation is materially misleading about operational behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains generic phrases such as "security audit", "run audit", and "security report" that are likely to match ordinary user requests rather than an explicit request for this specific skill. In an agent ecosystem, overly broad triggers can cause unintended activation of a skill that performs recurring audits, external report delivery, and cron-related setup, increasing the chance of accidental execution or privilege-impacting side effects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.