ClawHub
Back to skill

Security audit

OpenClaw Admin

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent OpenClaw administration guide, but it includes under-scoped guidance for sharing another agent's session transcripts and other high-impact admin patterns users should review carefully.

Install only from a source and revision you trust. Before using recipes that enable cross-agent memory search, agent-to-agent access, daemon/service install, cron, plugins, skills, or provider changes, review the exact config change and keep it narrowly scoped. Prefer HTTPS or encrypted tunnels for non-loopback model endpoints, store credentials in environment or secret references, and keep the skill's explicit confirmation and backup steps in place.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
references/multi-agent-recipes.md:290
Finding

Cross-Agent Session Transcript Access Weakens Agent Isolation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/models-and-providers.md:404
Finding

Bearer Credentials and Model Traffic Shown over Unencrypted LAN HTTP

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:45
Finding

Installation Instructions Retrieve Mutable Unpinned External Content

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

Clone into your Codex skills directory:

bash
mkdir -p ~/.codex/skills
git clone https://github.com/ramensushi2026/openclaw-cli-skill.git ~/.codex/skills/openclaw-cli

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

Clone into your Codex skills directory:

bash
mkdir -p ~/.codex/skills
git clone https://github.com/ramensushi2026/openclaw-cli-skill.git ~/.codex/skills/openclaw-cli

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description says to use this skill whenever the user asks how to run, configure, or troubleshoot any openclaw command or concept, followed by a very expansive list. This broad trigger lacks exclusion conditions or negative examples, so it may cause the skill to activate for almost any OpenClaw-related discussion, including cases where a narrower skill might be more appropriate.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
2. Run `openclaw doctor`.
    3. If any errors, **ABORT** the bounce.
- **BACKUP INTEGRITY:** Maintain a rotating history of up to 3 validated backups (`openclaw.json.bak.1` to `.bak.3`). After a verified successful bounce, prune any backups older than 24 hours and maintain the most recent 3 verified snapshots.
- **SECRET HYGIENE:** Never write credential-like patterns (`PAT`, `TOKEN`, `KEY`) into any workspace file. Before removing any existing configuration that contains keys/credentials, ensure they are secured in the environment (`~/.openclaw/credentials/.env`) first.
- **EXPLICIT AUTHORIZATION:** I must never make changes to the `openclaw.json` or system configuration without *first* proposing the change, explaining the "Why," and obtaining explicit user permission.
- **EXTERNAL SKILL AUDIT:** Never install a skill from ClawHub or any external repository without *first* inspecting the source code. Look specifically for:
    - Exfiltration of data/tokens to unknown URLs.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.

Examples:

bash
# Non-streaming
curl -sS http://127.0.0.1:18789/v1/chat/completions \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{"model":"openclaw/default","messages":[{"role":"user","content":"hi"}]}'

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/command-map.md (reported line 355)May include surrounding context.

md
openclaw gateway start               # start as background service
openclaw gateway stop
openclaw gateway restart
openclaw gateway install             # register launchd/systemd
openclaw gateway uninstall
openclaw gateway health              # fetch health via RPC
openclaw gateway status              # show service state

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/command-map.md (reported line 591)May include surrounding context.

bash
openclaw sandbox list
openclaw sandbox list --browser
openclaw sandbox recreate --all
openclaw sandbox recreate --agent coding
openclaw sandbox explain --agent coding

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 408)May include surrounding context.

md
"mode": "merge",
    "providers": {
      "<provider-id>": {
        "baseUrl": "https://api.example.com/v1",
        "apiKey": "${MY_API_KEY}",
        "api": "openai-completions",
        "models": [

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/command-map.md (reported line 480)May include surrounding context.

md
"mode": "merge",
    "providers": {
      "<provider-id>": {
        "baseUrl": "https://api.example.com/v1",
        "apiKey": "${MY_API_KEY}",
        "api": "openai-completions",
        "models": [

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/models-and-providers.md (reported line 331)May include surrounding context.

md
"mode": "merge",
    "providers": {
      "<provider-id>": {
        "baseUrl": "https://api.example.com/v1",
        "apiKey": "${MY_API_KEY}",
        "api": "openai-completions",
        "models": [

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/models-and-providers.md (reported line 364)May include surrounding context.

md
"mode": "merge",
    "providers": {
      "moonshot": {
        "baseUrl": "https://api.moonshot.ai/v1",
        "apiKey": "${MOONSHOT_API_KEY}",
        "api": "openai-completions",
        "models": [

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The document explicitly shows how one agent can search another agent's session transcripts by adding that agent's sessions directory as an extra collection, but it provides no warning that this bypasses normal isolation expectations and exposes prior conversation contents. In a multi-agent system where agents are described as isolated by workspace/auth/session boundaries, documenting cross-agent transcript access without privacy and consent guidance can lead to accidental overexposure of sensitive data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/openai-http-api.md (reported line 96)May include surrounding context.

Non-streaming chat completion

bash
curl -sS http://127.0.0.1:18789/v1/chat/completions \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The markdown documents openclaw models scan --set-default and --yes as convenience commands, but it does not warn that these options can automatically change the selected model/provider without an explicit user review step. Because switching models may send future prompts and related data to a different external provider, a brief disclosure would better inform users of the privacy and operational impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.