ClawHub
Back to skill

Security audit

Use OpenClaw Manual

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real OpenClaw documentation helper, but it has an unsafe document-read path that can escape the docs folder and expose local files.

Review before installing. Use it only if you are comfortable with shell scripts that fetch OpenClaw docs from GitHub and write under ~/.openclaw. Until fixed, avoid passing untrusted paths to --read or --list, consider disabling usage logs with DISABLE_USAGE_LOG=true, and keep DOC_NOTIFY_CHANNEL=none unless you accept sharing sync metadata.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/search-docs.sh:213
Finding

Arbitrary Local File Read Through Path Traversal

Content
View full analysis
Remediation
View remediation
&2 exit 1 fi local root target root=$(realpath "$LOCAL_DOCS") || exit 1 target=$(realpath -e "$root/$doc") || { echo "Document does not exist" >&2 exit 1 } case "$target" in "$root"/*.md) ;; *) echo "Document path is outside the documentation directory" >&2 exit 1 ;; esac if [ ! -f "$target" ]; then echo "Document is not a regular file" >&2 exit 1 fi cat -- "$target" } ``` Additional hardening measures: 1. Reject absolute paths and any input containing traversal components before resolution. 2. Restrict readable targets to regular `.md` files. 3. Use `realpath -e` so containment is checked after symlink resolution. 4. Add tests for `../`, absolute paths, symlinks escaping the root, missing arguments, and valid nested documents. 5. Run the Skill under an account with minimal access to credentials and unrelated workspace data. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
run.sh:10
Finding

Unsafe Persistent Logging of User-Controlled Search Terms

Content
View full analysis
> "$USAGE_LOG" } ``` The search branch records the complete user-supplied argument string: ```bash search_args="$*" matches=$(echo "$result" | grep -c . 2>/dev/null || echo 0) if [ "$matches" -gt 0 ]; then log_status="success" else log_status="no_results" fi log_usage "search" "$search_args" "$log_status" "$duration" "\"matches\":$matches" ``` ### Technical Analysis Usage logging is enabled by default and stores complete search arguments in `usage.log`. Search terms may contain sensitive configuration details, identifiers, internal hostnames, channel names, or credential fragments. The logger constructs JSON through direct shell string interpolation. It does not escape double quotes, backslashes, carriage returns, newlines, or other control characters. Consequently, attacker-controlled arguments can: - Produce malformed JSON records - Insert additional apparent fields - Inject extra lines and forge subsequent log records - Disrupt downstream usage analysis - Persist untrusted content in the project directory This is not shell command injection because the interpolated value is passed to `echo` inside quotes. The security problem is unsafe serialization and unnecessary persistence of potentially sensitive user input. ### Attack Path 1. An attacker influences a search query passed to `./run.sh --search`. 2. The query contains sensitive content o ...[truncated 1102 chars]
Remediation
View remediation
> "$USAGE_LOG" ``` 4. If arguments must be retained, redact likely secrets and limit their length before serialization. 5. Create the log with restrictive permissions: ```bash umask 077 touch "$USAGE_LOG" chmod 600 "$USAGE_LOG" ``` 6. Validate `USAGE_LOG_PATH` if untrusted environments can set it, and avoid overwriting sensitive or shared files. 7. Document the logging behavior, retention period, stored fields, and disable mechanism. 8. Add tests covering quotes, backslashes, newlines, control characters, very long arguments, and sensitive-value redaction. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
scripts/sync-docs.sh:195
Finding

Optional Notification Discloses the Absolute Local Documentation Path

Content
View full analysis
/dev/null || \ log "⚠️ Notification failed; the channel may not be configured" fi ``` ### Technical Analysis When notifications are enabled, the synchronization message includes the complete value of `OPENCLAW_MANUAL_PATH`. Its default value is beneath the user's home directory and therefore commonly reveals a local username, home path, workspace structure, and installation layout. The notification destination is selected by `DOC_NOTIFY_CHANNEL` and may represent a remote or shared channel. The reviewed code does not contain a hardcoded attacker endpoint, and notifications default to `none` in the implementation. Nevertheless, once enabled, including an absolute local path is unnecessary for reporting synchronization status and violates data minimization. ### Attack Path 1. A user or deployment configures `DOC_NOTIFY_CHANNEL` to a remote or shared OpenClaw channel. 2. The user runs document initialization or synchronization. 3. `send_notification` creates a message containing the absolute value of `OPENCLAW_MANUAL_PATH`. 4. `openclaw message send` transmits the message to the configured channel. 5. Channel participants or channel-side logging systems receive and retain local filesystem metadata. ### Impact Assessment The exposed information may reveal: - The local operating-s ...[truncated 369 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (41)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Persistent usage logging and exported shell helpers go beyond document retrieval and create an additional telemetry and code-reuse surface. Even if intended for observability, recording arguments, results, and timing can leak sensitive configuration terms or user context to local files without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Persistent usage logging and exported shell helpers go beyond document retrieval and create an additional telemetry and code-reuse surface. Even if intended for observability, recording arguments, results, and timing can leak sensitive configuration terms or user context to local files without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Persistent usage logging and exported shell helpers go beyond document retrieval and create an additional telemetry and code-reuse surface. Even if intended for observability, recording arguments, results, and timing can leak sensitive configuration terms or user context to local files without informed consent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Persistent usage logging and exported shell helpers go beyond document retrieval and create an additional telemetry and code-reuse surface. Even if intended for observability, recording arguments, results, and timing can leak sensitive configuration terms or user context to local files without informed consent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The guide includes a direct rm command against a file under the user's workspace without safeguards, confirmation, or validation. Even though the target is narrow, documentation in an automation-oriented skill can normalize unsafe shell execution patterns and may lead to accidental deletion or path confusion if adapted by users or agents.

Content

Scanner excerpt · references/troubleshooting.md (reported line 177)May include surrounding context.

解决:

bash
# 强制重新同步
rm ~/.openclaw/workspace/docs/openclaw_manual/.last-docs-commit
./run.sh --sync

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script analyzes usage telemetry instead of searching local official documentation, which materially differs from the declared purpose of the skill. In a security-sensitive agent ecosystem, capability drift is dangerous because operators may grant or invoke the skill expecting read-only doc access, while it actually processes behavioral logs and exposes operational metadata.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/sync-docs.sh (reported line 128)May include surrounding context.

sh
(
    cd "$temp_dir" || { log "❌ 进入临时目录失败"; return 1; }
    git sparse-checkout set "$GITHUB_DOCS_PATH" || { log "❌ 设置 sparse-checkout 失败"; return 1; }
  ) || { log "❌ git 操作失败"; rm -rf "$temp_dir"; return 1; }
  
  # 统计文件
  local new_count=0

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill metadata does not declare an explicit shell/tool scope, yet the content clearly instructs execution of shell scripts such as ./setup.sh and ./run.sh. This creates a permission-transparency gap: an agent or reviewer may believe the skill is documentation-only while it can actually invoke local commands that read/write files and access the network.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger activates on any mention of broad keywords like agent, session, tool, or config, which can cause the skill to run in many unrelated conversations. Over-broad auto-triggering increases the chance of unnecessary shell execution, file access, sync attempts, or data exposure in contexts where the user did not ask for this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest includes the keyword "chinese", and the description/changelog are written only in Chinese, indicating the skill is intended for a specific language context without stating any user choice or opt-in. The policy requires flagging language or locale constraints unless they are explicitly optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This JSON file contains multiple natural-language prompt values exclusively in Chinese, which can enforce a specific language/locale without offering user choice. The file does not document that the skill is intentionally Chinese-only or region-specific, so it appears to violate the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documented skill scope includes remote GitHub synchronization and notification delivery, which materially exceeds the stated purpose of merely consulting local documentation before configuration. This scope expansion creates extra network, filesystem, and outbound-messaging behavior that users may not expect from a documentation lookup skill, increasing the chance of unintended data flow or state changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation describes downloading remote content from GitHub and writing it into a local documentation directory, but does not warn about the trust boundary, overwrite behavior, storage impact, or the fact that local state will be modified. In a skill framed as 'consult local docs first,' this omission can mislead users into invoking operations with network and write side effects they did not anticipate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file documents that sync results may be sent through openclaw message or channel plugins, but it does not clearly warn that information will be transmitted externally. That lack of disclosure is risky because even operational summaries can expose local paths, repository usage, timing, or other metadata to third-party chat systems or plugins.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The troubleshooting guide instructs users to delete a state file to force re-synchronization, but it does not explain what the file does, what state will be lost, or how to back it up first. In an agent skill context, terse shell snippets are often copied verbatim, so undocumented deletion increases the chance of accidental disruption or misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This shell script presents its user-facing comments, help output, and error text entirely in Chinese, which imposes a specific language on users. The policy allows locale constraints only when they are optional or clearly justified; neither is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Comments and all visible status/output strings are written in Chinese only, which imposes a specific language on users without opt-in. Under the policy, fixed-language behavior is a natural-language locale violation unless the skill offers a choice or clearly documents a justified regional constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script performs an in-place write to usage.log by truncating it through log rotation, even though the skill is described as a documentation lookup aid. In an agent-skill context, unexpected mutation of local state violates least privilege and can destroy audit history or interfere with forensic review if the script is invoked automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The --list handler appends user-controlled input to $LOCAL_DOCS and validates only that the resulting path is a directory, which allows traversal such as '../' to enumerate directories outside the documentation tree. That can expose filesystem structure and filenames unrelated to the manual, undermining the skill's advertised scope and potentially disclosing sensitive project layout information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The --read path is concatenated with the docs root and only checked with -f, so inputs like '../secret.txt' can escape the intended documentation subtree and read arbitrary files accessible to the current user. In this skill's context, the script is explicitly meant to search local docs, so violating that trust boundary is more dangerous because an agent or user may assume reads are limited to documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script's comments, status logs, errors, and usage/help text are written in Chinese, making the operational interface effectively fixed to a specific language. The file does not provide any user opt-in, locale selection, or documented justification for this constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is presented as consulting local official documentation, but the script silently reaches out to GitHub and repopulates the local docs store from the network. That expands the trust boundary, introduces supply-chain and integrity risk, and may violate user expectations in restricted or offline environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The script is designed to contact api.github.com to discover documentation commits, which is an external transmission channel. In the context of a supposedly local-doc consultation skill, this matters because it leaks environment activity and depends on remote content and availability.

Content

Scanner excerpt · scripts/sync-docs.sh (reported line 17)May include surrounding context.

sh
# GitHub API 配置
GITHUB_REPO="openclaw/openclaw"
GITHUB_DOCS_PATH="docs"
GITHUB_API_BASE="https://api.github.com/repos/$GITHUB_REPO/contents/$GITHUB_DOCS_PATH"

# =============================================================================
# 依赖检查

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This code performs live GitHub API queries to determine the latest docs commit, creating an external dependency and network egress path. In a security-sensitive environment, even metadata lookups can be inappropriate if the skill is expected to operate only on already-local documentation.

Content

Scanner excerpt · scripts/sync-docs.sh (reported line 77)May include surrounding context.

sh
# =============================================================================
get_latest_commit() {
  local response
  response=$(github_api_get "https://api.github.com/repos/$GITHUB_REPO/commits?path=$GITHUB_DOCS_PATH&sha=main&per_page=1")
  
  local commit
  commit=$(echo "$response" | python3 -c "import sys, json; data=json.load(sys.stdin); print(data[0]['sha'] if data else '')" 2>/dev/null)

Static analysis

No suspicious patterns detected.