Security audit

Voice Input Patch – Dual Mic Buttons

Security checks for vulnerabilities and agentic risk

Overview

This skill is for a real OpenClaw voice UI patch, but it asks for broad filesystem searching and a persistent privileged ownership change that is too risky for the narrow file edit it needs.

Only install or use this if you intentionally want to patch OpenClaw's installed Control UI files. Do not run the recursive chown command as written; prefer copying only the exact target file, preserving a backup and original permissions, then restoring just that file with administrator review. Confirm the installation path and OpenClaw version before any edit.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:36
Finding: Unnecessarily Broad Filesystem Reconnaissance
Content: View full analysis
/dev/null | head -1 ``` ### Technical Analysis The Skill instructs the agent to search recursively from the filesystem root to locate an OpenClaw JavaScript asset. This search is broader than necessary for the stated patching task because the Skill also identifies a targeted alternative using `npm root -g`. Running `find /` traverses every directory and mounted filesystem accessible to the executing account. Redirecting standard error to `/dev/null` conceals permission failures and makes it difficult for the user to assess which protected locations were probed. In addition, `head -1` blindly selects the first matching file without verifying that it belongs to the intended OpenClaw installation. Although this command does not itself modify files or bypass operating-system permissions, it violates least-privilege principles by inspecting unrelated filesystem locations and may cause the agent to identify and subsequently modify an unintended installation. ### Attack Path 1. A user invokes the Skill to patch OpenClaw. 2. The agent executes the documented `find /` command. 3. The command recursively probes all readable directories and mounted filesystems. 4. Multiple OpenClaw installations or matching asset paths may be discovered. 5. `head -1` selects the first result without package-origin or installation validation. 6. Later patching instructions are applied to that path, potentially targeting the wrong installation. ### Impact Assessment The command can disclose accessible filesystem structure, including the presence and location of software installations on local or mounted filesystems. Its direct privileges remain limited to those of the executing account, but its scope includes every path that acc ...[truncated 290 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:53
Finding: Recursive Ownership Transfer of the Entire OpenClaw Distribution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description is broad enough to trigger on generic voice-input or patching requests, which can cause the agent to apply invasive file-modification instructions in situations the user did not explicitly scope to patching OpenClaw internals. In this context, overbroad activation increases the chance of unintended modification of production assets and unsafe operational guidance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to modify a built production asset under an installation directory and even to request copying files out of the install path, but it does not require an explicit warning about risks such as service breakage, version mismatch, or rollback necessity before proceeding. Because the target is a minified hashed JS bundle, mistakes are difficult to review and can easily leave the application in a broken or insecure state.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The skill tells the agent to ask the user to run a recursive sudo chown -R $(whoami) against the OpenClaw distribution directory to grant write access. That is dangerous because it normalizes privilege escalation and changes ownership of installed application files, which can weaken system integrity, break package-managed permissions, and create opportunities for unauthorized tampering with production code.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
> 1. Copy the file into my workspace so I can patch it, then copy it back after. Run this in your terminal: > `cp /path/to/openclaw/dist/control-ui/assets/index-*.js ~/.openclaw/workspace-allgemein/` > 2. Or give me write access: > `sudo chown -R $(whoami) /path/to/openclaw/dist/`" Keep it simple. Don't over-explain.