OpenClaw ElonTools Optimizer v3 — Safe Edition

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:45 AM UTC
• Version: 3.0.0

Overview

The skill is a disclosed OpenClaw optimizer, but its default preset can broadly change instance configuration, disable messaging integrations, and enforce session cleanup while describing the risk as zero.

Review this carefully before installing. It may be acceptable for a new or disposable OpenClaw instance, but do not apply the bundled preset to an instance with active messaging integrations or important session history unless you first make a backup and manually remove the plugin-disabling and session-pruning sections you do not want.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:61

Finding

Unconditional Preset Can Disable Active Channels and Delete Session History

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:61-67, references/preset-safe.json:12-28
Vulnerability Type: Unsafe and overly broad configuration modification
Risk Level: Medium

Complete Code Snippet (SKILL.md:61-67):

text

## Aplicação

Ler o preset

read("references/preset-safe.json")

Aplicar

gateway(action="config.patch", raw=<conteúdo do preset>)

text

Complete Code Snippet (references/preset-safe.json:12-28):

json

"session": {
  "maintenance": {
    "mode": "enforce",
    "pruneDays": 7,
    "maxEntries": 500
  }
},
"plugins": {
  "entries": {
    "whatsapp": { "enabled": false },
    "discord": { "enabled": false },
    "slack": { "enabled": false },
    "nostr": { "enabled": false },
    "googlechat": { "enabled": false },
    "imessage": { "enabled": false },
    "signal": { "enabled": false }
  }
}

Technical Analysis

The documented application procedure directs the agent to submit the entire preset through a single gateway(action="config.patch") operation. The preset unconditionally disables seven messaging plugins and enables enforced session pruning without first inspecting the current configuration, identifying active channels, creating a backup, or obtaining approval for each potentially disruptive change.

Although SKILL.md warns users not to apply the plugin optimization when one of these channels is in use, it provides neither a plugin-free preset nor a selective patch procedure. Consequently, the primary documented command remains unsafe for users who overlook the warning or do not know which integrations are active.

Enforced session maintenance can also remove session records older than seven days or beyond the configured entry limit. This operation may be irreversible and is inaccurately presented as carrying zero risk. These broad configuration changes exceed the minimum privileges and modifications n ...[truncated 1974 chars]

Remediation

View remediation

Remediation Suggestions

1. Split heartbeat selection, sub-agent archiving, session pruning, and plugin disabling into separate opt-in patches.
2. Make the default preset non-destructive by excluding plugin shutdown and enforced session deletion.
3. Call gateway(action="config.get") before modification and determine which plugins are configured or active.
4. Require explicit, per-channel confirmation before disabling any messaging integration.
5. Require separate confirmation before enabling session pruning, clearly identifying the retention period and entry limit.
6. Provide a dry-run mode that reports every proposed configuration change and affected resource.
7. Export or back up the existing configuration and session state before applying destructive changes.
8. Supply tested rollback instructions that restore previous plugin and maintenance settings.
9. Preserve active plugin settings by generating a selective patch rather than submitting a blanket preset.
10. Replace the “Zero” risk claim with an accurate warning covering service interruption and data-retention consequences.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language content of the skill is written entirely in Portuguese, including operational instructions and warnings, with no indication that the skill is region-specific or that users may choose another language. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern.

Content

No source excerpt is available for this finding.