Security audit
Security checks for vulnerabilities and agentic risk
This documentation-only skill does not run code itself, but it gives broad actionable instructions for weakening OpenClaw security controls and exposing sensitive data.
Treat this as an admin-only reference for isolated test environments. Do not install or use it on a production OpenClaw host unless you are prepared to ignore or heavily restrict the sections on disabling auth, exposing exec/admin tools, elevated mode, Docker binds, signed-in browser profiles, raw-stream logging, webhooks, and remote embedding providers.
SKILL.md:195Actionable Guidance for Disabling Access Controls and Escaping Sandboxes
SKILL.md:101Diagnostic Options Can Persist Sensitive Prompts and Unfiltered Model Streams
The debug and raw-stream logging sections describe collection of full or near-full model payloads, prompt text, and raw assistant streams, but do not prominently warn about sensitive data capture. This can expose secrets, prompts, personal data, or internal context in logs and local files.
The document gives explicit configuration steps to disable device authentication and webhook signature validation, and also discusses other severe security downgrades. Publishing such guidance in an unconstrained skill normalizes turning off core trust controls and can directly enable spoofing, unauthorized access, and host compromise.
The /elevated full guidance explicitly tells users how to run exec commands outside the sandbox and bypass approval gates. That is a direct path to arbitrary host command execution with reduced oversight, which is far beyond what an unknown-purpose skill should enable.
The documentation explains that Docker bind mounts can pierce the sandbox and specifically notes that binding /var/run/docker.sock gives host control. Even though it says 'NEVER DO THIS,' including concrete escape primitives in a permissive cheat-sheet style can enable host compromise when copied into practice.
agents.defaults.sandbox.docker.binds: ["/:/host:rw"] // NEVER DO THIS
docker.binds pierces the sandbox filesystem. Binding /var/run/docker.sock = host control. Use :ro for anything sensitive.
The browser automation section states that the user profile can control a signed-in Chrome session, but lacks a clear warning that this grants access to active accounts, cookies, session tokens, and private browsing data. That creates substantial account-takeover and privacy exposure risk.
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
### Path & Identity
| Var | Effect |
|---|---|
| `OPENCLAW_HOME` | Override system home for ALL internal paths |
| `OPENCLAW_STATE_DIR` | Override state dir (default `~/.openclaw`) |
| `OPENCLAW_CONFIG_PATH` | Override config file path |
| `OPENCLAW_WORKSPACE_DIR` | Override agent workspace |
This section documents direct HTTP tool invocation and explicitly explains how to override deny lists to re-enable dangerous tools such as gateway/admin capabilities. In a skill with no constrained purpose or safety framing, this materially lowers the barrier to privileged action and can enable command execution, session manipulation, or control-plane abuse.
The phrase 'Invoke any available tool directly via HTTP without running an agent turn' advertises a broad, low-friction path to tool execution. In a skill with no purpose limitation, that expands attack surface and can bypass normal conversational or policy-mediated checks.
POST /tools/invoke — Direct Tool InvocationStatus: ALWAYS ENABLED. No config needed.
Invoke any available tool directly via HTTP without running an agent turn:
curl -sS http://127.0.0.1:18789/tools/invoke \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Invoke any available tool directly via HTTP without running an agent turn:
curl -sS http://127.0.0.1:18789/tools/invoke \
-H 'Authorization: Bearer TOKEN' \
-H 'Content-Type: application/json' \
-d '{"tool":"sessions_list","args":{}}'
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
gateway.controlUi.dangerouslyDisableDeviceAuth: true
Effect: Disables Control UI device identity checks. SEVERE SECURITY DOWNGRADE. Treat like sudo -i.
dangerouslyDisableSignatureValidationCommands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
gateway.controlUi.dangerouslyDisableDeviceAuth: true
Effect: Disables Control UI device identity checks. SEVERE SECURITY DOWNGRADE. Treat like sudo -i.
dangerouslyDisableSignatureValidationThe skill explicitly mentions skipping approval gates when running outside the sandbox. That removes human or policy review from the execution path for highly privileged operations, sharply increasing the chance of arbitrary misuse and irreversible system changes.
Effect: Removes tools from the default HTTP deny list for owner/admin callers. In identity-bearing auth, cron, gateway, nodes still need operator.admin.
/elevated fullEffect: Run exec commands OUTSIDE sandbox AND skip approval gates. Requires tools.elevated.enabled: true + sender on allowlist.
This section documents cron-based command execution and webhook delivery automation, including command/env/stdin control. In an unconstrained skill, that enables persistent unattended execution and off-host data delivery, which increases the risk of abuse and persistence.
Webhook delivery features are described as routine options without a strong notice that outputs and metadata may be transmitted off-host to external systems. Users may unknowingly exfiltrate sensitive task results or internal state.
This example explicitly configures a remote embedding endpoint and API key, enabling transmission of memory-search queries and documents to an external service. Without context, minimization guidance, or privacy notice, this can expose sensitive internal data off-host.
agents.defaults.memorySearch: {
provider: "openai-compatible",
model: "text-embedding-3-small",
remote: { baseUrl: "https://api.example.com/v1/", apiKey: "YOUR_KEY" },
queryInputType: "query",
documentInputType: "passage"
}
The closing language encourages users to enable dangerous capabilities like gateway.tools.allow: ["exec"] without any trigger constraints or safety preconditions. Broad activation phrasing around powerful features can prompt unsafe enabling in contexts where users do not understand the consequences.
The package description explicitly promotes 'hidden features, env vars, debug flags, and power-user tricks' for OpenClaw and GCP, which suggests the skill is intended to help users discover non-public functionality and sensitive configuration details. In the context of a skill package, this framing increases the likelihood of guidance that could expose secrets, weaken access controls, or encourage unsafe operational practices.
No suspicious patterns detected.