OpenClaw Anything (efrageek fork)

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:31 PM UTC
• Version: 1.0.3

Overview

This skill is a disclosed OpenClaw CLI wrapper and documentation companion with high-risk operations called out and mostly gated behind explicit opt-in.

Install this only if you intend to administer an OpenClaw environment. Review commands before running them, set OPENCLAW_WRAPPER_ALLOW_RISKY=1 only for a specific high-risk task, and be especially careful with service installation, cron changes, plugin installation, browser automation, device pairing, messaging, and non-loopback gateway exposure.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Security Policy

Last verified: 2026-02-17.

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Security Policy

Last verified: 2026-02-17.

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Security Policy

Last verified: 2026-02-17.

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Security Policy

Last verified: 2026-02-17.

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Security Policy

Last verified: 2026-02-17.

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Security Policy

Last verified: 2026-02-17.

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Security Policy

Last verified: 2026-02-17.

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# OpenClaw Security Policy

Last verified: 2026-02-17.

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

- Do not chain high-risk actions into unattended workflows by default.

## High-risk Categories
- Shell execution features (`exec`) that can run arbitrary commands
- Elevated privilege flows
- Sub-agent delegation with inherited environment/context
- Plugin install from external sources

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.