Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly an OpenClaw setup guide, but its examples and troubleshooting steps could expose an assistant to untrusted users or delete local OpenClaw data without adequate warnings.
Review and tighten the configuration before installing: bind the gateway to 127.0.0.1 unless you intentionally need LAN access, use Telegram pairing or an explicit allowlist instead of open wildcard access, avoid pipe-to-shell installers when possible, pin package versions, and do not run the reset commands unless you have a full backup outside ~/.openclaw.
SKILL.md:58Remote installer is downloaded and executed without integrity verification
publish.sh:16Global npm installations use mutable or unspecified dependency versions
examples/openclaw.json:4Example configuration exposes the gateway and Agent to untrusted users
examples/telegram-setup.md:198Troubleshooting guidance may print a Telegram bot credential
SKILL.md:241Windows maintenance command terminates every Node.js process
SKILL.md:324Reset procedure recursively deletes credentials and all OpenClaw state
There is a clear description-behavior mismatch. The declared purpose says this skill helps users install, configure, and start OpenClaw on their systems. However, the code shown is a publishing utility for distributing a skill to ClawHub. Its primary actions are related to release management and platform publishing: ensuring the clawhub CLI exists, verifying login status, validating skill files, collecting a changelog, and invoking clawhub publish. It does not perform OpenClaw installation, configuration, gateway startup, or OS-specific setup tasks. These are materially different purposes, so this should be flagged as a mismatch.
Piping curl output directly into bash combines external content retrieval with immediate execution, eliminating the user's chance to review what will run. In the context of an installation skill, this pattern is especially risky because users are primed to trust and copy-paste setup commands verbatim.
# Install nvm
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
# Reload shell
source ~/.zshrc # or ~/.bashrc
rm -rf ~/.openclaw irreversibly removes the entire OpenClaw state directory, including credentials, sessions, logs, workspace, and possibly custom skills or memory data. In a troubleshooting guide, destructive recursive deletion is dangerous because users may execute it quickly under stress without understanding the blast radius.
# Backup and reset (macOS/Linux)
cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak
rm -rf ~/.openclaw
openclaw onboard
# Backup and reset (Windows PowerShell)
rm -rf ~/.openclaw irreversibly removes the entire OpenClaw state directory, including credentials, sessions, logs, workspace, and possibly custom skills or memory data. In a troubleshooting guide, destructive recursive deletion is dangerous because users may execute it quickly under stress without understanding the blast radius.
# Backup and reset (macOS/Linux)
cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak
rm -rf ~/.openclaw
openclaw onboard
# Backup and reset (Windows PowerShell)
The troubleshooting guidance recommends kill -9 <PID>, killall, Stop-Process, and taskkill /F style force termination without warning that this may abruptly stop the gateway or other unrelated Node-based processes. Abrupt termination can cause data corruption, lost logs, and service interruption, especially where process matching is broad.
The guide tells users to run sudo chown -R $(whoami) ~/.npm, which performs a recursive privileged ownership change. While often used to fix npm permission issues, privileged recursive filesystem operations can unintentionally alter permissions more broadly than needed and normalize unsafe use of sudo in setup documentation.
3. Permission denied:
# macOS/Linux
sudo chown -R $(whoami) ~/.npm
# Windows (run PowerShell as Administrator)
npm cache clean --force
The reset instructions delete the entire ~/.openclaw or %USERPROFILE%\.openclaw directory, which can erase credentials, sessions, logs, workspace data, and other state. Because the guide presents this as routine troubleshooting without a prominent data-loss warning or narrower alternatives, users may irreversibly destroy important local data.
The example configuration exposes the gateway on 0.0.0.0 and also enables a Telegram interface with permissive defaults, creating remotely reachable control surfaces rather than a narrowly scoped local setup example. In an installation/setup skill, shipping an example that normalizes broad network exposure can lead users to deploy an unnecessarily accessible agent service without understanding the security implications.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
]
},
openai: {
baseUrl: "https://api.openai.com/v1",
apiKey: "${OPENAI_API_KEY}",
models: [
{ id: "gpt-5.2", name: "GPT-5.2", contextWindow: 128000 },
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
]
},
openai: {
baseUrl: "https://api.openai.com/v1",
apiKey: "${OPENAI_API_KEY}",
models: [
{ id: "gpt-5.2", name: "GPT-5.2", contextWindow: 128000 },
The Telegram bot interface is enabled with dmPolicy set to open and allowFrom set to ["*"], which effectively permits interaction from any sender. That creates an unnecessary remote command/input channel for an agent setup example and increases the chance of unauthorized use, abuse, or prompt-driven actions through the bot interface.
The file combines credential-based integration (Telegram bot token and API keys via environment variables) with an openly reachable inbound messaging configuration, but provides no visible warning about exposure, abuse, or secret-handling expectations. While the secrets themselves are placeholders, the example may encourage unsafe deployment patterns where operators enable remote access without appreciating the consequences.
Using allowFrom: ["*"] is overly permissive access control because it authorizes messages from any sender instead of an approved allowlist. If the bot can trigger agent behaviors, an attacker or random third party could interact with the system and potentially cause data exposure, unwanted actions, or service misuse.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Complete guide to set up Telegram integration with OpenClaw.
## Step 1: Create Telegram Bot
1. Open Telegram and search for **@BotFather**
2. Send `/newbot` command
The guide presents a public bot configuration using dmPolicy: "open" and allowFrom: ["*"] without a clear warning that this exposes the bot to messages from any Telegram user. In the context of an AI gateway, this can lead to unauthorized interaction, privacy issues, abuse, and unexpected cost or data exposure if the bot is connected to internal capabilities.
The always-active group configuration instructs users to set requireMention: false and activation: "always" but does not warn that the bot will process every message in the group. This increases the risk of inadvertent collection of sensitive group content, noisy triggering, prompt injection from any participant, and elevated operational cost.
The command fetches a remote script and pipes it directly into bash, executing network-retrieved code without inspection or integrity verification. If the remote content, transport path, or upstream repository is compromised, users can execute attacker-controlled code immediately on their system.
# Install nvm
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
# Reload shell
source ~/.zshrc # or ~/.bashrc
No suspicious patterns detected.