OpenClaw Docs

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:13 PM UTC
• Version: 1.0.1

Overview

This is a static OpenClaw documentation bundle that describes powerful features, but the skill itself does not install code, run commands, or hide behavior.

Install this as reference documentation, not as a source of commands to run automatically. Before following examples, review whether they enable shell execution, hooks, cron jobs, browser control, Gmail body forwarding, public webhooks, chat delivery, config writes, or persistent logs, and keep tokens and service-account files protected with least-privilege access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (178)

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The documentation explicitly describes a feature where prefixing input with `!` executes an arbitrary local shell command on the TUI host. In a documentation-reference skill, exposing this capability is dangerous because an agent may surface or operationalize it in response to user prompts, enabling host-side command execution and turning a read-only docs skill into an execution-enabling capability.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation includes examples that push generated briefings and summaries directly to external channels such as WhatsApp without any warning about data sensitivity, recipient verification, or consent. In an automation skill, this can normalize exfiltration of emails, calendar data, and news summaries to third-party services, increasing the risk of unintended disclosure of personal or organizational information.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The heartbeat guidance encourages periodic access to inboxes, calendars, notifications, and idle-status check-ins, but does not mention least-privilege access, consent, retention, or sensitivity review. Because heartbeat runs are recurring and context-aware, they can continuously process private user data and surface or forward it in ways users may not expect.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation shows a configuration that forwards Gmail sender, subject, snippet, and potentially body content into OpenClaw and optionally delivers it to a chat channel, but it does not prominently warn that this may expose sensitive email contents to additional systems, models, or messaging surfaces. In an automation skill, this omission increases the chance that users enable broad data forwarding without understanding privacy, retention, or unintended-recipient risks.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documented `gog gmail watch serve` example includes `--include-body`, which enables transmission of email body content to OpenClaw, yet there is no immediate warning that message bodies may contain secrets, regulated data, or personal information. Because this is an operational copy-paste command, users may enable full-content forwarding by default and unintentionally broaden exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly describes a bundled hook that silently logs all command events, including sender identifiers and source, to a centralized file. Even though this is presented as an audit feature, collecting personal identifiers in the background without a clear privacy warning, retention policy, consent model, or redaction guidance creates a real privacy and compliance risk if enabled in production.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation states that MS Teams poll votes are persisted to `~/.openclaw/msteams-polls.json` and that the gateway must remain online to record them, but it does not warn about local retention, access controls, or operational/privacy implications. In a messaging/automation context this can lead to unanticipated storage of user interaction data on disk, increasing privacy, compliance, and host data exposure risk if the filesystem is shared, backed up, or insufficiently protected.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document promotes fan-out of a single user message to multiple agents, and examples elsewhere include agents with write and exec permissions, but it does not warn that one prompt can trigger multiple autonomous actions. In this context, that omission can lead to duplicated side effects, unexpected command execution, or concurrent writes from agents that users may not realize are all active.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The task automation example explicitly includes agents that update task databases and log activity, yet the documentation provides no caution about automatic writes, logging of potentially sensitive project data, or compounded effects when multiple agents act on the same message. In a multi-agent broadcast setting, this increases the chance of unintended data modification, privacy issues, and duplicate operations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation states that channel-initiated config writes from Discord are enabled by default, which can let users modify runtime configuration through chat commands if command features are active. Even if normal auth checks apply, exposing configuration mutation over a chat channel materially increases the attack surface and can enable misconfiguration, privilege abuse, or persistence if allowlists or command auth are weak or mistakenly broad.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs users to place the Feishu App Secret in a plaintext config file and shell environment variables, but does not clearly warn about exposure through file permissions, shell history, process inspection, backups, or logs. While common in setup docs, this materially increases the chance of credential leakage and bot account compromise if users follow the examples verbatim.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to generate and download a Google service-account JSON key and place it on the gateway host, but it does not explicitly emphasize that this file is a highly sensitive credential that must be access-controlled, excluded from source control, and rotated if exposed. Such keys can enable unauthorized API access or impersonation of the Chat app if leaked through backups, logs, shared directories, or repository commits.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly describes injecting non-triggering group messages into model context and appending sender names and phone numbers, but it does not pair this with a clear privacy warning, consent requirement, or data-minimization guidance. In a group-chat setting this can expose participant metadata and prior messages to the agent in ways users may not reasonably expect, increasing privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation tells users to provide Matrix credentials and explicitly states that the resulting access token is stored locally in a credentials file, but it does not warn about the sensitivity of those secrets, expected file permissions, or host security requirements. In a security-sensitive messaging integration, this omission can lead to credential exposure through weak workstation hygiene, backups, or overbroad filesystem access.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly recommends `chatmode: "onmessage"`, which causes the agent to process every channel message. In a messaging integration skill, this materially expands exposure to prompt injection, unintended data handling, and noisy or unauthorized bot responses, and the page does not prominently warn about those security/privacy tradeoffs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that if `Chat.Read.All` is missing, file sharing falls back to an organization-wide link, which broadens access beyond the intended chat participants. Even though this is presented as behavior rather than code, documenting and encouraging this fallback without a prominent warning can lead operators to deploy a configuration that exposes sensitive files to the whole tenant.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that channel-initiated config writes are enabled by default, which allows actions originating from a chat channel to modify configuration unless explicitly disabled. In a messaging-channel context, this increases the attack surface for unauthorized or socially engineered configuration changes, especially because the doc does not pair this default with a strong warning, safe-default guidance, or approval controls.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The documentation includes a realistic-looking bot token directly in configuration examples without clearly labeling it as a dummy placeholder or warning users not to commit real secrets. This can normalize unsafe secret-handling practices and increase the chance that users paste real tokens into configs, screenshots, or version control.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The guide tells users to expose a webhook URL and configure a webhook secret, but it does not explicitly warn that this endpoint receives untrusted external requests and that the secret must be protected and verified on every request. That omission can lead to weak deployments where webhook validation is skipped or secrets are disclosed in logs and configs.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation shows commands that replace exec approvals from a file on the local host, gateway, or node host, but does not warn that this changes host-level execution policy and can broaden what commands agents may run. In an agent skill context, users may copy-paste these commands without understanding they are modifying a security boundary across infrastructure components.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The documentation describes browser control over existing Chrome tabs, screenshots, snapshots, clicks, and typing, but does not place a prominent warning near these commands that they can expose page contents, session data, or trigger actions in a user's live browser context. In a skill/docs corpus intended for agent consumption, that omission increases the chance of unsafe use against sensitive tabs or authenticated sessions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The command-logger hook records all command events to a centralized log file, which can capture sensitive prompts, operational actions, workspace details, or user behavior. In an agent platform context, silent or under-warned logging increases the risk of privacy leakage, credential exposure in command arguments, and long-term sensitive data retention on disk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The session-memory hook writes session context to disk automatically when /new is issued, and session context may contain secrets, personal data, or internal operational details. In documentation for an automation platform, failing to warn users about persistent storage of potentially sensitive context can lead to unintended disclosure through local compromise, backups, sync tools, or shared machines.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The documentation exposes destructive actions such as delete, kick, ban, and timeout without any nearby warning, confirmation guidance, or emphasis on required authorization. In an agent-skill context, this increases the chance that an LLM-driven operator or automation will invoke high-impact commands on live communities without recognizing the operational risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This documentation explicitly advertises remote shell-style execution via `nodes run` and `--raw`, including `/bin/sh -lc` or `cmd.exe /c`, but does not present any prominent warning about command execution risk, trust boundaries, or the consequences of running commands on paired nodes. In a skill intended as a broad documentation reference, that omission can normalize dangerous use and increase the chance that users or downstream agents invoke shell commands on remote devices without adequate validation or approval awareness.

VirusTotal

65/65 vendors flagged this skill as clean.