ClawHub
Back to skill

Security audit

Openclaw Uninstaller

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent OpenClaw uninstall guide, but it recommends irreversible, non-interactive deletion and unpinned remote package execution without enough safeguards.

Install only if you are comfortable with a destructive uninstall guide. Prefer the local openclaw uninstall command over npx, avoid elevated shells, review every deletion path first, and back up any OpenClaw state or workspace data before running the forced cleanup commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:21
Finding

Unpinned Remote Package Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 21
Vulnerability Type: Unverified execution of a mutable third-party package
Risk Level: High

Vulnerable Code:

bash
npx -y openclaw uninstall --all --yes --non-interactive

Technical Analysis

The documented command instructs npx to resolve, download, and execute the current registry version of the openclaw package. No exact version or package integrity value is specified, so the code executed by users can change after this Skill has been audited.

The -y option automatically accepts installation prompts, while --yes --non-interactive suppresses application-level confirmation. These options reduce the user's opportunity to inspect the resolved package and operation before execution. A compromised package publisher, registry account, package release, or dependency could therefore turn this uninstall command into arbitrary code execution.

This behavior is not strictly necessary for the declared uninstall functionality. The already-installed openclaw executable shown elsewhere in the document is a safer option because it does not require downloading mutable code during uninstallation.

Attack Path

  1. An attacker compromises the openclaw package, a package maintainer account, or a dependency incorporated into a new release.
  2. The attacker publishes a malicious version under the package name resolved by npx.
  3. A user follows the documented uninstallation instructions.
  4. npx -y downloads and executes the malicious package without version pinning or interactive package approval.
  5. Malicious package lifecycle scripts or runtime code execute with the privileges of the invoking user.

Impact Assessment

Successful exploitation permits arbitrary code execution under the invoking user's account. This can expose files, environment variables, API credentials, OpenClaw state, and any other resources accessible to that account ...[truncated 203 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer the locally installed and previously verified CLI:

    bash
    openclaw uninstall --all --yes --non-interactive

  • If remote package execution must remain available, pin an explicitly reviewed version rather than resolving the latest release:

    bash
    npx --yes openclaw@<reviewed-version> uninstall --all --yes --non-interactive

  • Verify the package publisher, registry, exact version, and published integrity metadata before execution.

  • Avoid recommending elevated execution and document that the command should run with ordinary user privileges.

  • Remove automatic confirmation where practical so users can inspect the package and operation before execution.

  • Prefer an authenticated, integrity-locked installation process over ad hoc execution from a mutable registry.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:41
Finding

Unrestricted Recursive Deletion Through Environment-Controlled Path

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 41
Vulnerability Type: Unsafe recursive deletion using an insufficiently validated path
Risk Level: High

Vulnerable Code:

bash
rm -rf "${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"

Technical Analysis

The command recursively and forcibly deletes the path supplied through OPENCLAW_STATE_DIR. Shell quoting prevents word splitting and direct shell metacharacter injection, but it does not ensure that the resolved path belongs to OpenClaw.

If the environment variable is mistakenly or maliciously set to an unrelated directory, such as the user's home directory or another writable data directory, rm -rf will delete that target without prompting. The fallback path is reasonably specific, but the environment-controlled branch has no checks for empty, root, home, parent-directory, symlink, or otherwise unexpected targets.

Removing application state is consistent with uninstallation, but accepting an arbitrary deletion target exceeds the minimum scope required. The operation should be constrained to a verified OpenClaw state directory.

Attack Path

  1. An attacker, wrapper script, shell profile, or erroneous configuration assigns OPENCLAW_STATE_DIR to a directory containing unrelated user data.
  2. The user follows the manual uninstall instructions in the same environment.
  3. Parameter expansion selects the attacker-controlled or erroneous path instead of $HOME/.openclaw.
  4. rm -rf recursively deletes the selected directory without confirmation.
  5. Files writable by the invoking account are irreversibly removed unless recoverable from backups.

Impact Assessment

Exploitation can destroy any files and directories writable by the invoking user beneath the selected target. Under a normal account, this may include personal documents, source repositories, configuration, credentials, and application data. If executed with elevated privileges, ...[truncated 130 chars]

Remediation
View remediation

Remediation Suggestions

  • Resolve the deletion target first and display it to the user before performing deletion.

  • Canonicalize the path and reject dangerous targets, including /, the user's home directory, empty values, and paths outside expected OpenClaw state locations.

  • Require an OpenClaw-specific basename or validate a trusted marker inside the directory before deletion.

  • Reject symbolic-link targets and revalidate the target immediately before deletion to reduce path substitution risks.

  • Use an explicit confirmation prompt for custom state directories rather than combining arbitrary path expansion with rm -rf.

  • Do not recommend running the cleanup command with administrative privileges.

  • A safer implementation should follow this pattern:

    bash
    target="${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"
canonical_target="$(realpath -- "$target")"

case "$canonical_target" in
  "$HOME/.openclaw"|"$HOME"/.openclaw-*)
    printf 'Deleting OpenClaw state directory: %s\n' "$canonical_target"
    rm -rf -- "$canonical_target"
    ;;
  *)
    printf 'Refusing to delete unexpected path: %s\n' "$canonical_target" >&2
    exit 1
    ;;
esac

  • Adapt the allowlist if legitimate state directories can exist elsewhere, but require explicit validation and confirmation for those locations.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

rm -rf "${OPENCLAW_STATE_DIR:-$HOME/.openclaw}" deletes a path influenced by an environment variable, which can widen the deletion target unexpectedly if the variable is mis-set, attacker-controlled, or empty in edge cases. In a copy-paste skill, encouraging recursive forced deletion on variable-derived paths raises the chance of unintended filesystem damage beyond the application's state directory.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

第三步：删除配置文件

bash
rm -rf "${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"

第四步：删除 workspace（可选但建议）

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

第四步：删除 workspace（可选但建议）

bash
rm -rf ~/.openclaw/workspace

第五步：卸载 CLI

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

第四步：删除 workspace（可选但建议）

bash
rm -rf ~/.openclaw/workspace

第五步：卸载 CLI

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

macOS 桌面版

bash
rm -rf /Applications/OpenClaw.app

系统服务清理

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

macOS 桌面版

bash
rm -rf /Applications/OpenClaw.app

系统服务清理

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

bash
launchctl bootout gui/$UID/ai.openclaw.gateway
rm -f ~/Library/LaunchAgents/ai.openclaw.gateway.plist

Linux

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

bash
systemctl --user disable --now openclaw-gateway.service
rm -f ~/.config/systemd/user/openclaw-gateway.service
systemctl --user daemon-reload

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

Windows

powershell
schtasks /Delete /F /TN "OpenClaw Gateway"
Remove-Item -Force "$env:USERPROFILE\.openclaw\gateway.cmd"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The one-click uninstall commands use --all --yes --non-interactive, which suppress prompts and perform irreversible cleanup automatically. In a skill context where users may execute commands verbatim, the lack of a prominent warning materially increases the risk of accidental destructive action.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The skill recommends executing npx -y openclaw uninstall --all --yes --non-interactive without pinning a specific package version. Because npx resolves and runs the current package from the registry, a compromised, typo-squatted, or newly changed package version could execute arbitrary code on the user's machine during uninstall.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This section gives destructive deletion commands for state and workspace data but does not clearly warn that the removal is permanent and may erase user data. Users may copy-paste the commands expecting routine cleanup and unintentionally destroy application state, prompts, logs, or other workspace contents.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

bash
launchctl bootout gui/$UID/ai.openclaw.gateway
rm -f ~/Library/LaunchAgents/ai.openclaw.gateway.plist

Linux

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The title, description, and all instructions are presented only in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate the language/locale policy when a specific language is effectively forced without opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
SKILL.md:47