Security audit

Jasper ConfigGuard

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real OpenClaw configuration tool, but it can change and restart a live gateway and has flaws that could expose, corrupt, or misapply configuration.

Review carefully before installing or letting an agent use this on a production OpenClaw gateway. Prefer a pinned reviewed package version, test in staging, keep an independent backup, restrict permissions on ~/.openclaw and its backups, and avoid passing untrusted backup IDs or patch files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:12
Finding: Unpinned npm Package Installation and Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/index.js:250
Finding: Backup Identifier Path Traversal
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/index.js:242
Finding: Configuration Backups Are Created Without Explicit Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/index.js:237
Finding: Non-Atomic Replacement of the Active Configuration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/index.js:258
Finding: Broad Process Matching May Signal Unrelated Processes
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README promotes live configuration changes, gateway restarts, and rollback behavior as routine operations, but does not prominently warn that these actions can interrupt service, affect availability, or apply invalid or dangerous configuration state. In an operational tool that modifies a running gateway, omission of an explicit warning increases the likelihood of unsafe use in production and can lead to self-inflicted denial of service.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The README instructs users to execute the package via npx without pinning a specific version, which causes the latest published package to be fetched and run at execution time. If the package is ever compromised, typo-squatted, or a malicious update is published, users may execute unreviewed code immediately with whatever privileges their shell provides.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 162)May include surrounding context.
md
- Node.js 18+ - OpenClaw gateway running on localhost:18789 - Write access to `~/.openclaw/` ## License

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The library advertises safe config management with automatic rollback, but the rollback path does not guarantee recovery to a healthy state. In patch(), if the new config fails health checks and the subsequent restore plus restart also fails, the function returns an error while leaving the gateway unhealthy, which can create a false sense of safety and lead to downtime or partial misconfiguration.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/index.js:227