ClawHub
Back to skill

Security audit

Openclaw User Onboarding

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its onboarding purpose, but it needs review because it persists personal setup data, schedules recurring messages, and includes unsafe guidance about giving credentials to the agent.

Review before installing. Be comfortable with the skill creating persistent workspace files and a recurring cron job, and avoid storing sensitive contact details unless needed. Do not give passwords, recovery codes, private keys, or long-lived tokens to the agent. If you install it, review USER.md and ONBOARDING_PROGRESS.md, know how to pause or delete the cron job, and do not run clawhub sync --all unless you intend to publish every eligible local skill.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:390
Finding

Overbroad Bulk Publication Command May Expose Unrelated Skills

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:390-395
Vulnerability Type: Overbroad publication scope
Risk Level: Medium

Vulnerable Code:

markdown
To share with others, publish to ClawHub:

```bash
clawhub sync --all
text

### Technical Analysis

The documented command uses the global `--all` option even though the stated operation is to publish this individual onboarding skill. Depending on the OpenClaw CLI's configured scope, the command may synchronize every eligible local skill instead of limiting publication to `openclaw-onboarding`.

This violates least-scope principles for publication operations. Local skill directories may contain proprietary instructions, internal service information, credentials embedded in configuration, or unfinished content that was never intended for public distribution. The issue does not require code execution by an attacker; it relies on a user following an unnecessarily broad command presented by the skill.

### Attack Path

1. A user installs or reviews this skill and follows its sharing instructions.
2. The user runs `clawhub sync --all`.
3. The CLI enumerates all eligible skills in its configured local scope.
4. Unrelated skills are synchronized to ClawHub alongside this project.
5. If those skills contain private or sensitive material, that material becomes accessible through the publication destination according to its visibility settings.

### Impact Assessment

The command does not directly grant local system privileges. Its impact is on the confidentiality and publication scope of local skill content. It could disclose unrelated proprietary instructions, internal URLs, operational configuration, or secrets stored in other skills. The maximum scope is all content selected by the CLI's `--all` behavior under the invoking user's account and workspace.
Remediation
View remediation

Remediation Suggestions

  • Replace clawhub sync --all with a CLI command explicitly scoped to openclaw-onboarding.
  • If the CLI does not support a skill-specific sync operation, instruct users to publish from an isolated directory containing only the intended skill.
  • Add a mandatory pre-publication review step that displays the exact files, skill names, destination, and visibility.
  • Warn users not to publish files containing credentials, private endpoints, personal data, or proprietary instructions.
  • Recommend testing the command with a dry-run or listing option, if supported, before performing the upload.

other

Warning
Location
SKILL.md:260
Finding

Unsafe Guidance Encourages Users to Disclose Reusable Credentials to the Agent

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:260-267
Vulnerability Type: Unsafe credential-handling guidance
Risk Level: Medium

Vulnerable Code:

markdown
**6. Browser automation**
> "I have access to a dedicated browser I can control — clicking, filling
> forms, taking screenshots, extracting data from pages. It's isolated from
> your personal browser, so it's safe to hand me credentials for specific tasks."
> Example: "Log into my GitHub, check for new security alerts, and summarise them."

Technical Analysis

Browser isolation reduces interaction with a user's personal browser profile, but it does not make transmitting reusable credentials through an AI conversation inherently safe. Credentials supplied to the agent may enter conversation history, model context, tool invocation parameters, screenshots, browser storage, diagnostic logs, or third-party telemetry.

The statement presents isolation as sufficient protection without identifying these additional exposure channels. Because this text is part of the scheduled onboarding curriculum, it may affirmatively encourage inexperienced users to disclose passwords or other authentication material to the agent.

Attack Path

  1. The onboarding cron job delivers the browser-automation introduction to the user.
  2. The introduction asserts that handing credentials to the agent is safe.
  3. The user sends a username, password, access token, recovery code, or other reusable secret in the conversation.
  4. The secret enters the agent's context and may be passed to browser automation tools.
  5. The credential may subsequently remain in chat history, logs, screenshots, browser state, or service telemetry.
  6. Any party or component with access to those records may recover and misuse the credential.

Impact Assessment

Exploitation could compromise any account whose credentials the user supplies. The resulting privileges are thos ...[truncated 494 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the assertion that it is safe to hand credentials to the agent.
  • Explicitly instruct users never to place passwords, recovery codes, private keys, or long-lived tokens in chat.
  • Prefer user-controlled interactive login, allowing the user to enter credentials directly into the isolated browser without exposing them to the agent.
  • Use OAuth or device-authorization flows where available.
  • For automation credentials, use short-lived, narrowly scoped tokens delivered through an approved secret manager rather than conversation text.
  • Require multi-factor authentication and limit token permissions to the minimum necessary operations.
  • Clear browser storage and terminate authenticated sessions after completing sensitive tasks.
  • Inform users about possible persistence in conversation history, screenshots, logs, and tool telemetry before any authentication workflow.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README prominently advertises automatic onboarding but does not clearly warn up front that the skill will create and persist multiple workspace files automatically. In this context, silent or under-disclosed modification of persistent agent state is security-relevant because users may install it expecting a passive tutorial, while it actually changes long-lived configuration and behavior on first run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README says the skill asks for personal details such as name, channel, goal, and timezone and stores them in workspace files, but it does not include a clear privacy or data-handling warning. Because these details are persisted in plain workspace state and may influence future sessions, the lack of disclosure increases the risk of users unknowingly storing personal profiling data in a long-lived location.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The installation instructions place the skill into the user's persistent OpenClaw workspace and state that onboarding begins automatically on the next session. In this skill's context, persistence matters because the skill is designed to be always loaded, auto-trigger, maintain onboarding state, and schedule recurring introductions, so installing it has ongoing behavioral effects beyond a single session.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

md
git clone https://github.com/dukesky/openclaw-onboarding.git

# Copy the skill into your OpenClaw workspace
mkdir -p ~/.openclaw/workspace/skills/openclaw-onboarding
cp openclaw-onboarding/SKILL.md ~/.openclaw/workspace/skills/openclaw-onboarding/

# Start a new session — onboarding begins automatically

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The top-level description presents the skill as simple onboarding but omits that it will write multiple workspace files, create persistent cron jobs, and potentially send scheduled messages. This weakens informed consent and increases the chance that users enable persistent automation and data flows they did not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The discovery phase collects personal data such as name, timezone, primary messaging channel, and user goals, then later persists it to workspace files and uses it for message delivery, but no privacy notice or consent checkpoint is provided before collection. This creates a privacy risk because sensitive personal preferences and routing details are retained and reused without explicit informed consent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to persist user profile data, scheduling preferences, channel information, and delivery targets into workspace files and background jobs. Centralizing personal metadata and outbound routing info in persistent files increases the blast radius of workspace compromise and enables future automated actions using that stored data without renewed user approval.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

Writing USER.md creates persistent session memory containing personal profile fields, including name, messaging habits, goals, and timezone. Persistence is not inherently unsafe, but storing personal data by default without access controls, minimization, or explicit consent creates a real privacy and retention risk.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md
Store both the cron expression and a human-readable description in
`ONBOARDING_PROGRESS.md`.

### 3b — Write USER.md

Create or update `USER.md` in the workspace:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill creates a cron job that can deliver automated messages to an external channel using user-provided channel and contact details. For a local onboarding flow, this expands scope from workspace setup into outbound messaging and could cause unintended data disclosure, spam, or messages sent to the wrong recipient if the stored target is inaccurate or later abused.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The onboarding script tells users that the heartbeat is an idle cycle that runs every 30 minutes and implies it has already been set up. Earlier setup steps only create a HEARTBEAT.md file and an onboarding intro cron job; there is no instruction anywhere here to schedule a 30-minute heartbeat job. This is an active contradiction between the documentation shown to the user and the actions the skill actually performs.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
70% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

md
> Example: "Log into my GitHub, check for new security alerts, and summarise them."

**7. Sub-agents**
> "For long or parallel tasks, I can spawn background workers that run
> independently and report back. Your main conversation stays responsive while
> the work happens in parallel."
> Example: "Research three competing products at the same time and compare them."

Static analysis

No suspicious patterns detected.