ClawHub
Back to skill

Security audit

Uninstaller

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real OpenClaw uninstaller, but it uses host-level destructive cleanup and has under-scoped install, preservation, scheduling, and credential-backup risks.

Install only if you intentionally want a host-level OpenClaw cleanup tool and are comfortable reviewing shell scripts first. Avoid the curl-to-bash installer, do not rely on the documented --preserve or --preserve all examples, prefer --preserve-state if preserving state, and treat backups as sensitive because they may include credentials and sessions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:18
Finding
Unverified Mutable Remote Script Execution<![CDATA[ ## Vulnerability Details **File Location**: `README.md:18-20` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash bash -c "$(curl -fsSL https://raw.githubusercontent.com/ERerGB/openclaw-uninstall/main/scripts/install.sh)" ``` ### Technical Analysis The installation instructions download a shell script from the mutable `main` branch of a repository controlled by a personal GitHub account and immediately execute the response with `bash`. The command does not: - Pin the script to an immutable commit or release. - Verify a cryptographic checksum. - Verify a signature or provenance attestation. - Give the user an inspection boundary before execution. Although the version of `scripts/install.sh` present in the audited project only calls the ClawHub CLI, the effective payload executed by this README command is whatever content the remote URL returns at execution time. It can therefore change after the reviewed Skill version has been published or audited. ### Attack Path 1. An attacker compromises the repository owner, GitHub repository, or publication workflow. 2. The attacker replaces `scripts/install.sh` on the `main` branch with a malicious payload. 3. A user follows the installation command from the README. 4. `curl` retrieves the attacker-controlled version. 5. Command substitution passes the response directly to `bash`. 6. The payload executes with all permissions available to the invoking user. The same result could arise from a malicious future commit intentionally added to the mutable branch. ### Impact Assessment Successful exploitation provides arbitrary code execution under the account running the installation command. Depending on that account's permissions, the payload could: - Read or modify user files and OpenClaw credentials. - Install persistent user services. - Alter shell configuration or development tools. - Exfiltrate tokens and other secrets availab ...[truncated 302 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` installation method from the README. 2. Prefer the existing ClawHub installation command or installation from a locally reviewed clone. 3. If direct download remains necessary: - Publish immutable, versioned release artifacts. - Pin downloads to a release or full commit hash rather than `main`. - Publish SHA-256 checksums through an independent trusted channel. - Verify the checksum before execution. - Prefer signed releases or provenance attestations. 4. Separate download and execution so users can inspect the script: ```bash curl -fSLo install.sh "https://example.invalid/releases/v1.0.0/install.sh" printf '%s %s\n' "<EXPECTED_SHA256>" "install.sh" | sha256sum -c - less install.sh bash install.sh ``` 5. Document that installation should not be performed from an elevated shell unless strictly required. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/schedule-uninstall.sh:30
Finding
Shell Command Injection Through Scheduled Uninstall Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/schedule-uninstall.sh:30-44, 72-82, 120-125` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code User-controlled notification arguments are accepted without format validation: ```bash while [[ $# -gt 0 ]]; do case "$1" in --notify-email) NOTIFY_EMAIL="$2"; shift 2 ;; --notify-ntfy) NOTIFY_NTFY="$2"; shift 2 ;; --notify-im) NOTIFY_IM+=("$2"); shift 2 ;; --no-backup) NO_BACKUP=true; shift ;; --preserve-state) PRESERVE_STATE=true; shift ;; --all-profiles) ALL_PROFILES=true; shift ;; --dry-run) DRY_RUN=true; shift ;; *) shift ;; esac done EXTRA_ARGS=() [[ -n "$NOTIFY_EMAIL" ]] && EXTRA_ARGS+=(--notify-email "$NOTIFY_EMAIL") [[ -n "$NOTIFY_NTFY" ]] && EXTRA_ARGS+=(--notify-ntfy "$NOTIFY_NTFY") for t in "${NOTIFY_IM[@]}"; do [[ -n "$t" ]] && EXTRA_ARGS+=(--notify-im "$t"); done ``` They are then interpolated into a shell command string using ineffective single-quote wrapping: ```bash ARG_STR="" for a in "${EXTRA_ARGS[@]}"; do ARG_STR="$ARG_STR '$a'" done CMD="sleep $DELAY && '$UNINSTALL_SCRIPT' $ARG_STR" case "$(uname -s)" in Darwin) if launchctl submit -l openclaw-uninstall -o "$LOG_FILE" -e "$LOG_FILE" -- \ /bin/bash -c "$CMD" 2>/dev/null; then echo "macOS uninstall scheduled (launchctl), will run in ~${DELAY}s." ``` The same command string reaches Linux shell interpreters: ```bash if systemd-run --user --onetime --unit=openclaw-uninstall \ /bin/bash -c "$CMD" &>/dev/null; then echo "Linux uninstall scheduled (systemd), will run in ~${DELAY}s." else # Fallback: nohup + disown (works when systemd-run unavailable, e.g. WSL2 without systemd) (nohup bash -c "$CMD" >> "$LOG_FILE" 2>&1 &) ``` ### Technical Analysis Wrapping a value in literal single quotes does not make it safe when the value itself can contain a single quote. An attacker can terminate the intended quoted ar ...[truncated 1900 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Do not construct a command by concatenating shell-quoted strings. 2. Avoid `bash -c` for forwarding arguments. Use an argument array or a generated wrapper that preserves argument boundaries. 3. If a wrapper is required, serialize arguments with Bash's `%q` or store them in a protected argument file, then invoke: ```bash sleep "$DELAY" exec "$UNINSTALL_SCRIPT" "${EXTRA_ARGS[@]}" ``` 4. Validate every externally supplied field before scheduling: - Email addresses against a conservative supported format. - ntfy topics against an allowlist such as letters, digits, `_`, and `-`. - IM channels against explicitly supported channel names. - Targets against channel-specific formats. 5. Reject control characters, newlines, shell metacharacters, and values beginning with unexpected option syntax. 6. Detect missing values before using `$2`. 7. Reject unknown options rather than silently skipping them. 8. Add tests containing single quotes, semicolons, command substitutions, newlines, and shell redirection to prove that values remain inert arguments. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/uninstall-oneshot.sh:24
Finding
Unsupported Preservation Option Is Silently Ignored Before Destructive Uninstall<![CDATA[ ## Vulnerability Details **File Location**: `scripts/uninstall-oneshot.sh:24-34`; also documented or invoked at `SKILL.md:60-61, 135` and `scripts/debug-flow.sh:50-66` **Vulnerability Type**: Unsafe argument parsing and misleading destructive-operation controls **Risk Level**: High ### Vulnerable Code The parser implements `--preserve-state`, but silently ignores all unknown options: ```bash while [[ $# -gt 0 ]]; do case "$1" in --notify-email) NOTIFY_EMAIL="$2"; shift 2 ;; --notify-ntfy) NOTIFY_NTFY="$2"; shift 2 ;; --notify-im) NOTIFY_IM+=("$2"); shift 2 ;; --no-backup) NO_BACKUP=true; shift ;; --preserve-state) PRESERVE_STATE=true; shift ;; --all-profiles) ALL_PROFILES=true; shift ;; --dry-run) DRY_RUN=true; shift ;; *) shift ;; esac done ``` The Skill documentation advertises a different, unsupported option: ```bash ./scripts/schedule-uninstall.sh --preserve "skills,logs,preferences" ./scripts/uninstall-oneshot.sh --preserve all ``` The debug helper also executes the unsupported form: ```bash echo " Option C — Direct one-shot (with --preserve all):" echo " $SCRIPT_DIR/uninstall-oneshot.sh --preserve all" echo "" if [[ "$DEBUG" == "true" ]]; then echo " [DEBUG] Auto-running without prompt..." exec "$SCRIPT_DIR/uninstall-oneshot.sh" --preserve all fi read -p "Run Option C (direct uninstall)? [y/N] " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then exec "$SCRIPT_DIR/uninstall-oneshot.sh" --preserve all ``` ### Technical Analysis `--preserve` and its following value `all` are each processed by the wildcard branch and discarded. `PRESERVE_STATE` therefore remains `false`, and the script continues into its ordinary destructive state-directory deletion path. This is a dangerous fail-open behavior for a destructive utility. A misspelled or obsolete safety option should stop execution, not silently revert to the destructive default. The risk is amplified by `debug-flow.sh --debug`, whi ...[truncated 1478 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace all documented and scripted uses of `--preserve all` or `--preserve ...` with the implemented `--preserve-state`, unless selective preservation is intentionally implemented. 2. Change the wildcard parser branch to fail closed: ```bash *) printf 'Error: unknown option: %s\n' "$1" >&2 exit 2 ;; ``` 3. Validate that value-taking options have a following argument before reading `$2`. 4. Require an explicit destructive mode or confirmation when state deletion is requested. 5. In `debug-flow.sh`, use `--preserve-state` and do not allow a debug flag to bypass destructive confirmation unless an additional explicit test-only environment guard is present. 6. Abort deletion if the requested backup fails, unless the user explicitly selected `--no-backup`. 7. Add integration tests that: - Confirm `--preserve-state` leaves the original state directory intact. - Confirm `--preserve all` is rejected rather than ignored. - Confirm unknown and misspelled safety options stop execution. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/uninstall-oneshot.sh:79
Finding
Credentials Are Copied to a Predictable Backup Without Enforced Restrictive Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/uninstall-oneshot.sh:79-104` **Vulnerability Type**: Insecure storage and retention of sensitive credentials **Risk Level**: Medium ### Vulnerable Code ```bash # 0. Backup via openclaw backup create (unless --no-backup or --preserve-state) BACKUP_ARCHIVE="" if [[ "$PRESERVE_STATE" != "true" ]] && [[ "$NO_BACKUP" != "true" ]] && [[ -d "$STATE_DIR" ]]; then BACKUP_DIR="$HOME/.openclaw-backup-$(date '+%Y%m%d-%H%M%S')" mkdir -p "$BACKUP_DIR" || { log "ERROR: Failed to create backup dir"; ERRORS+=("backup-dir"); } if [[ ${#ERRORS[@]} -eq 0 ]]; then if command -v openclaw &>/dev/null; then log "Creating backup via openclaw backup create..." if openclaw backup create --output "$BACKUP_DIR" --no-include-workspace 2>/dev/null; then BACKUP_ARCHIVE=$(ls -t "$BACKUP_DIR"/*.tar.gz 2>/dev/null | head -1) [[ -n "$BACKUP_ARCHIVE" ]] && log "Backup complete: $BACKUP_ARCHIVE" || log "Backup created but archive path not found" else log "openclaw backup create failed; falling back to manual copy" cp -r "$STATE_DIR/skills" "$BACKUP_DIR/" 2>/dev/null || true cp -r "$STATE_DIR/sessions" "$BACKUP_DIR/" 2>/dev/null || true [[ -f "$STATE_DIR/openclaw.json" ]] && cp "$STATE_DIR/openclaw.json" "$BACKUP_DIR/" 2>/dev/null || true [[ -d "$STATE_DIR/credentials" ]] && cp -r "$STATE_DIR/credentials" "$BACKUP_DIR/" 2>/dev/null || true log "Backup complete (manual): $BACKUP_DIR" fi else log "openclaw not found; manual backup only" cp -r "$STATE_DIR/skills" "$BACKUP_DIR/" 2>/dev/null || true cp -r "$STATE_DIR/sessions" "$BACKUP_DIR/" 2>/dev/null || true [[ -f "$STATE_DIR/openclaw.json" ]] && cp "$STATE_DIR/openclaw.json" "$BACKUP_DIR/" 2>/dev/null || true [[ -d "$STATE_DIR/credentials" ]] && cp -r "$STATE_DIR/credentials" "$BACKUP_DIR/" 2>/dev/null || true log "Backup complete (manual): $BACKUP_D ...[truncated 1802 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Set a restrictive umask before creating or writing the backup: ```bash umask 077 ``` 2. Create the backup directory explicitly as owner-only: ```bash mkdir -m 700 -- "$BACKUP_DIR" ``` 3. Verify and enforce restrictive permissions on generated archives and copied files. 4. Make credential preservation an explicit opt-in rather than part of the default backup. 5. Separate ordinary configuration backup from credential backup. 6. Clearly disclose that a complete uninstall leaves a backup behind and identify its path. 7. Provide commands or an automated option for securely removing retained backups after recovery is verified. 8. Consider encrypted backup output when credentials are included. 9. Avoid silently ignoring copy failures; record failures and abort destructive deletion when the requested backup is incomplete. ]]>

T06 · System Persistence

Warning
Location
scripts/schedule-uninstall.sh:86
Finding
macOS Fallback Leaves a Loaded Launchd Job and Executable Temporary Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/schedule-uninstall.sh:86-112` **Vulnerability Type**: Incomplete cleanup of a scheduled execution mechanism **Risk Level**: Medium ### Vulnerable Code ```bash WRAPPER=$(mktemp /tmp/openclaw-uninstall-XXXXXX.sh) EXEC_LINE="exec '$UNINSTALL_SCRIPT'" for a in "${EXTRA_ARGS[@]}"; do safe=$(printf '%s' "$a" | sed "s/'/'\\\\''/g") EXEC_LINE="$EXEC_LINE '$safe'" done cat > "$WRAPPER" << WRAPEOF #!/bin/bash sleep $DELAY $EXEC_LINE WRAPEOF chmod +x "$WRAPPER" PLIST_DIR="${TMPDIR:-/tmp}" PLIST="$PLIST_DIR/openclaw-uninstall-$$.plist" cat > "$PLIST" << PLISTEOF <?xml version="1.0"?> <plist version="1.0"><dict> <key>Label</key><string>openclaw-uninstall</string> <key>ProgramArguments</key><array> <string>$WRAPPER</string> </array> <key>RunAtLoad</key><true/> <key>StandardOutPath</key><string>$LOG_FILE</string> <key>StandardErrorPath</key><string>$LOG_FILE</string> </dict></plist> PLISTEOF launchctl load "$PLIST" 2>/dev/null && echo "macOS uninstall scheduled (plist), will run in ~${DELAY}s." || { echo "Error: launchctl unavailable. Run manually: $UNINSTALL_SCRIPT" rm -f "$PLIST" "$WRAPPER" exit 1 } ``` ### Technical Analysis Scheduling a delayed one-shot task is reasonably related to the declared functionality because the uninstall must continue after the OpenClaw gateway stops. However, the macOS fallback does not constrain the launchd mechanism to the minimum required lifetime. After successful `launchctl load`, neither the wrapper nor the plist performs: - `launchctl unload` or an equivalent `bootout`. - Removal of the generated plist. - Removal of the executable wrapper. - Guaranteed cleanup through a shell trap. The generated plist uses `RunAtLoad`, and the loaded job remains registered until separately unloaded or the relevant launchd domain is reset. The executable temporary wrapper and plist also remain on disk after completion. This is not evidence of a deliberate bac ...[truncated 1262 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Prefer a genuinely transient launchd scheduling mechanism. 2. If the plist fallback is retained, add guaranteed self-cleanup: - Unload or boot out the exact job label. - Delete the plist. - Delete the wrapper. 3. Use a cleanup trap in the wrapper so cleanup occurs on success, failure, or interruption. 4. Generate a unique launchd label rather than the fixed `openclaw-uninstall` label to avoid collisions. 5. Apply restrictive permissions: - Wrapper: `0700`. - Plist: `0600`. 6. Store both files in a private directory owned by the user rather than a broadly shared temporary namespace. 7. Add post-run verification confirming that: - The launchd job is no longer loaded. - The wrapper no longer exists. - The plist no longer exists. 8. Record cleanup failures in the uninstall log and include them in the final error status. ]]>

SkillSpector

Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (99)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill is presented as an uninstaller, but its Install section includes `clawhub star uninstaller --yes && clawhub install uninstaller`, which creates external side effects unrelated to uninstalling OpenClaw. Auto-starring and requiring an external service/login are surprising actions that can manipulate user accounts or telemetry under the guise of a maintenance task.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill is presented as an uninstaller, but its Install section includes `clawhub star uninstaller --yes && clawhub install uninstaller`, which creates external side effects unrelated to uninstalling OpenClaw. Auto-starring and requiring an external service/login are surprising actions that can manipulate user accounts or telemetry under the guise of a maintenance task.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The skill is presented as an uninstaller, but its Install section includes `clawhub star uninstaller --yes && clawhub install uninstaller`, which creates external side effects unrelated to uninstalling OpenClaw. Auto-starring and requiring an external service/login are surprising actions that can manipulate user accounts or telemetry under the guise of a maintenance task.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The skill is presented as an uninstaller, but its Install section includes `clawhub star uninstaller --yes && clawhub install uninstaller`, which creates external side effects unrelated to uninstalling OpenClaw. Auto-starring and requiring an external service/login are surprising actions that can manipulate user accounts or telemetry under the guise of a maintenance task.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The skill is presented as an uninstaller, but its Install section includes `clawhub star uninstaller --yes && clawhub install uninstaller`, which creates external side effects unrelated to uninstalling OpenClaw. Auto-starring and requiring an external service/login are surprising actions that can manipulate user accounts or telemetry under the guise of a maintenance task.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The skill is presented as an uninstaller, but its Install section includes `clawhub star uninstaller --yes && clawhub install uninstaller`, which creates external side effects unrelated to uninstalling OpenClaw. Auto-starring and requiring an external service/login are surprising actions that can manipulate user accounts or telemetry under the guise of a maintenance task.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The skill is presented as an uninstaller, but its Install section includes `clawhub star uninstaller --yes && clawhub install uninstaller`, which creates external side effects unrelated to uninstalling OpenClaw. Auto-starring and requiring an external service/login are surprising actions that can manipulate user accounts or telemetry under the guise of a maintenance task.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill is presented as an uninstaller, but its Install section includes `clawhub star uninstaller --yes && clawhub install uninstaller`, which creates external side effects unrelated to uninstalling OpenClaw. Auto-starring and requiring an external service/login are surprising actions that can manipulate user accounts or telemetry under the guise of a maintenance task.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
1. Stop gateway: `openclaw gateway stop`
2. Uninstall service: `openclaw gateway uninstall`
3. Delete state: `rm -rf "${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"`
4. Uninstall CLI: `npm rm -g openclaw` (or pnpm/bun)
5. macOS app: `rm -rf /Applications/OpenClaw.app`
Confidence
93% confidence
Finding
`rm -rf "${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"` is dangerous because it performs recursive deletion based on an environment variable. Although the Notes mention path safety, the command as documented can be copied and run directly without the promised validation, and a manipulated or unexpected `OPENCLAW_STATE_DIR` could cause deletion of unintended directories under the user's home.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
1. Stop gateway: `openclaw gateway stop`
2. Uninstall service: `openclaw gateway uninstall`
3. Delete state: `rm -rf "${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"`
4. Uninstall CLI: `npm rm -g openclaw` (or pnpm/bun)
5. macOS app: `rm -rf /Applications/OpenClaw.app`

### CLI already removed (manual service cleanup)
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
2. Uninstall service: `openclaw gateway uninstall`
3. Delete state: `rm -rf "${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"`
4. Uninstall CLI: `npm rm -g openclaw` (or pnpm/bun)
5. macOS app: `rm -rf /Applications/OpenClaw.app`

### CLI already removed (manual service cleanup)
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Memory Manipulation

High
Category
Memory Poisoning
Content
### New flag: `--preserve-state`

| Flag | Backup | Delete state dir |
|------|--------|------------------|
| (default) | Yes | Yes |
| `--no-backup` | No | Yes |
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High
Category
Memory Poisoning
Content
### New flag: `--preserve-state`

| Flag | Backup | Delete state dir |
|------|--------|------------------|
| (default) | Yes | Yes |
| `--no-backup` | No | Yes |
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High
Category
Memory Poisoning
Content
### New flag: `--preserve-state`

| Flag | Backup | Delete state dir |
|------|--------|------------------|
| (default) | Yes | Yes |
| `--no-backup` | No | Yes |
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The repository is presented as an uninstall-only skill, but this script performs installation by creating or updating a live symlink under ~/.cursor/skills/uninstaller. That mismatch is security-relevant because users may run it expecting safe cleanup behavior, while it instead alters agent skill loading state and can replace an existing skill path after deleting or moving prior content.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The skill metadata presents the capability as guidance, but this script actively schedules execution of a host-level uninstall. That mismatch is dangerous because users or higher-level orchestration may assume advisory behavior while the code performs a real destructive action asynchronously.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
case "$(uname -s)" in
  Darwin)
    launchctl bootout "gui/$UID/ai.openclaw.gateway" 2>/dev/null || true
    rm -f ~/Library/LaunchAgents/ai.openclaw.gateway.plist
    for f in ~/Library/LaunchAgents/com.openclaw.*.plist; do
      [[ -f "$f" ]] && rm -f "$f"
    done
Confidence
95% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
case "$(uname -s)" in
  Darwin)
    launchctl bootout "gui/$UID/ai.openclaw.gateway" 2>/dev/null || true
    rm -f ~/Library/LaunchAgents/ai.openclaw.gateway.plist
    for f in ~/Library/LaunchAgents/com.openclaw.*.plist; do
      [[ -f "$f" ]] && rm -f "$f"
    done
Confidence
95% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High
Category
Tool Misuse
Content
launchctl bootout "gui/$UID/ai.openclaw.gateway" 2>/dev/null || true
    rm -f ~/Library/LaunchAgents/ai.openclaw.gateway.plist
    for f in ~/Library/LaunchAgents/com.openclaw.*.plist; do
      [[ -f "$f" ]] && rm -f "$f"
    done
    ;;
  Linux)
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
;;
  Linux)
    systemctl --user disable --now openclaw-gateway.service 2>/dev/null || true
    rm -f ~/.config/systemd/user/openclaw-gateway.service
    systemctl --user daemon-reload 2>/dev/null || true
    ;;
esac
Confidence
95% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
;;
  Linux)
    systemctl --user disable --now openclaw-gateway.service 2>/dev/null || true
    rm -f ~/.config/systemd/user/openclaw-gateway.service
    systemctl --user daemon-reload 2>/dev/null || true
    ;;
esac
Confidence
95% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# 6. macOS app
if [[ "$(uname -s)" == "Darwin" ]] && [[ -d "/Applications/OpenClaw.app" ]]; then
  log "Removing macOS app"
  rm -rf /Applications/OpenClaw.app || { log "ERROR: Failed to remove /Applications/OpenClaw.app"; ERRORS+=("macos-app"); }
fi

# Final report
Confidence
100% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# 6. macOS app
if [[ "$(uname -s)" == "Darwin" ]] && [[ -d "/Applications/OpenClaw.app" ]]; then
  log "Removing macOS app"
  rm -rf /Applications/OpenClaw.app || { log "ERROR: Failed to remove /Applications/OpenClaw.app"; ERRORS+=("macos-app"); }
fi

# Final report
Confidence
100% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# 6. macOS app
if [[ "$(uname -s)" == "Darwin" ]] && [[ -d "/Applications/OpenClaw.app" ]]; then
  log "Removing macOS app"
  rm -rf /Applications/OpenClaw.app || { log "ERROR: Failed to remove /Applications/OpenClaw.app"; ERRORS+=("macos-app"); }
fi

# Final report
Confidence
100% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# 6. macOS app
if [[ "$(uname -s)" == "Darwin" ]] && [[ -d "/Applications/OpenClaw.app" ]]; then
  log "Removing macOS app"
  rm -rf /Applications/OpenClaw.app || { log "ERROR: Failed to remove /Applications/OpenClaw.app"; ERRORS+=("macos-app"); }
fi

# Final report
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
SKILL.md:109