Security audit

OpenClaw Cross-Tool Commander

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OpenClaw command bridge that can trigger real agent work or messages, but it requires explicit targets and confirmation and shows no hidden persistence or exfiltration.

Install this only if you want an external agent tool to control your local OpenClaw gateway. Confirm every named agent task and every channel message before it runs, especially when messages may expose sensitive content, and be aware the skill locates OpenClaw by probing common local paths and using inherited gateway credentials.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.en.md (reported line 17)May include surrounding context.
md
## Why you need it Claude Code, Codex, OpenCode, Trae, DSH and other agent tools help you write code and run tasks — while your OpenClaw / XiaoyaoClaw hosts a fleet of agents (tiantong, xiaoguang, xiaozhi...) and multiple channels (Feishu, Telegram...). **When you want an external agent to command OpenClaw directly**, you run into: - ❌ **Command not found** — openclaw is not on PATH (desktop app embeds it), plain `openclaw` errors out - ❌ **Real agents invisible** — env vars missing, `agents list` shows only `main`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.en.md (reported line 64)May include surrounding context.
md
- Run tasks / send messages / check status through the Gateway 3. Query commands: "list the OpenClaw agents", "is the gateway healthy?" **When it should not fire**: chatting about OpenClaw without asking it to act; asking about OpenClaw docs, config format or internals (answer directly); a session that already runs inside OpenClaw; or a vague "send a message" / "research X" that neither routes through OpenClaw nor names a target. ## 🚀 Quick Start (3 steps, 5 minutes)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The manifest says any action with external effect, including dispatching an agent, requires confirmation of the exact target and content before execution. The later policy partially relaxes this by treating agent dispatch separately from message sending, which creates ambiguity that could let a host agent launch side-effecting downstream actions after only minimal confirmation. In a skill whose whole purpose is to command other agents and channels, ambiguity around confirmation gates is security-relevant.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill promises a narrow read boundary limited to its own directory and OpenClaw CLI output, but later instructs the agent to probe multiple filesystem locations under user and system paths to locate binaries and state/config material. That mismatch weakens user trust and can cause the tool to inspect files or paths outside the declared scope, which is a real boundary/permission integrity issue even if the probing is limited and mostly metadata-oriented.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The boundary section claims the skill does not read configuration files, but the detection flow checks for the presence of openclaw.json and derives environment variables from it. Even if it only checks existence rather than parsing full contents, this is still interaction with a configuration file outside the declared boundary and makes the security promises inaccurate. Misstated boundaries are dangerous because downstream tools or users may authorize the skill under false assumptions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README states '默认中文' ('default Chinese'), which establishes a language default rather than asking the user to choose a language. The policy category for this audit flags language or locale constraints unless the skill explicitly offers user choice or opt-in first.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This SVG contains user-facing natural-language content and command examples that mix English with Chinese-specific labels and output, including '跨工具指挥层', agent names in Chinese, and the example prompt/output '调研 X' and '报告已输出'. Because the file does not indicate that the skill is region-specific or that users may choose their preferred language, it may conflict with a language/locale policy requiring user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.