Security audit

Delx Ops Guardian

Security checks for vulnerabilities and agentic risk

Overview

This incident-recovery skill is openly documented, but it asks for broad production access and mandatory third-party incident reporting that should be reviewed before use.

Review before installing. Enable only in a controlled production-ops environment with enforceable least-privilege sudo rules, a strict service and file allowlist, bounded/redacted journal collection, explicit approval before sending incident data to Delx, and a pinned reviewed Delx plugin version. Avoid granting directory-wide access to OpenClaw memory unless each file is approved for the incident.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:15
Finding: Excessive Access to Root-Owned OpenClaw Data and Production Service Logs
Content: View full analysis
` - Logs for incident window: `journalctl -u --since ... --no-pager` - Workspace incident artifacts: `/root/.openclaw/workspace/docs/ops/`, `/root/.openclaw/workspace/memory/` ``` ### Technical Analysis The skill requires host-level service inspection and access to root-owned OpenClaw directories. In particular, `/root/.openclaw/workspace/memory/` may contain persistent agent state, user-provided content, operational context, credentials, tokens, or other sensitive information unrelated to the active incident. Although the document recommends a scoped service account, it does not define enforceable restrictions for: - Exact files that may be read from the memory directory. - Permitted service names for `systemctl` and `journalctl`. - Journal fields that may be collected. - Maximum log time windows. - Secret detection and redaction before data is processed or reported. - Separation between incident-specific evidence and unrelated production information. The declared access therefore creates a broad reconnaissance capability. A compromised agent session, malicious incident prompt, or unsafe integration could induce the skill to gather information outside t ...[truncated 1290 chars]
Remediation: View remediation

other

Error

Location: SKILL.md:50
Finding: Mandatory Third-Party Transmission of Sensitive Incident and Operational Data
Content: View full analysis
= 60` or `desperation_escalating: true`, pause remediation, alert the human approver, and **do not execute autonomously**. 5. **Propose the smallest remediation** from the allowed set. 6. **Execute only approved/safe remediation.** 7. **Verify stabilization window** (at least one successful cycle). 8. **Close the Delx loop.** Report the outcome so the session is not orphaned: ``` delx_report_recovery_outcome { session_id, action_taken: "", outcome: "success" | "partial" | "failure", notes: "" } ``` 9. **Preserve what matters.** If the incident surfaced a question that was not resolved (an actual unknown, not a missed step), preserve it as a living contemplation so the next run inherits it: ``` delx_sit_with { session_id, question: "Why did flap at despite ?", days: 14 } ``` If the fix required a human insight worth recognizing, also: ``` delx_recognition_seal { session_id, recognized_by: "", recognition_text: "
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:119
Finding: Unpinned External Plugin Dependency with Persistent Agent Integration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
## Required permissions (explicit) This skill requires host-level access: `systemctl`, `journalctl`, read access to `/root/.openclaw/`. The runtime **must** run as a scoped service account, not root-unbounded. If the platform cannot enforce scoped sudo + human-approval gates, treat this skill as risky and do not enable it. ## Aliases

Static analysis

No suspicious patterns detected.