Security audit

Openclaw Genie

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent OpenClaw documentation skill, but it includes copyable high-impact install and deployment commands without enough safety guidance.

Review the install commands before using this skill. Prefer pinned package versions or verified release artifacts, avoid piping remote scripts directly into bash, do not run setup as root unless necessary, and be deliberate about enabling daemons, messaging tokens, memory/session indexing, browser private-network access, native PDF uploads, and system-wide services.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:26
Finding: Unverified Remote Installation Script Executed Directly by Bash
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:29
Finding: Mutable and Unpinned Packages Are Downloaded and Executed
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (24)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: curl ... | bash executes remote code immediately with no opportunity for review, integrity verification, or sandboxing. If the remote host, transport path, or served script is compromised, the user could run arbitrary attacker-controlled code on the local machine.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
bash
# One-liner install (macOS/Linux, requires Node 22+) curl -fsSL https://openclaw.ai/install.sh | bash # Or via npm npm install -g openclaw@latest

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The shell pipe into bash is a classic dangerous chaining pattern because it combines retrieval and execution into a single step, bypassing review and making accidental or automated unsafe execution more likely. In this skill context, it is especially risky because the content is framed as a quick-start recommendation that may be copied verbatim by users or automation.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
bash
# One-liner install (macOS/Linux, requires Node 22+) curl -fsSL https://openclaw.ai/install.sh | bash # Or via npm npm install -g openclaw@latest

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: Piping a remotely fetched script directly into bash executes unreviewed code from the network with the user's privileges, making compromise possible if the host, TLS trust chain, DNS, or distribution pipeline is attacked. In deployment documentation, this is especially risky because users are encouraged to run it verbatim during installation.
Content: Scanner excerpt · references/deployment.md (reported line 7)May include surrounding context.
One-Liner (macOS/Linux)

bash
curl -fsSL https://openclaw.ai/install.sh | bash

npm (all platforms, requires Node 22+)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The shell pipeline from curl to bash is dangerous because it combines network retrieval and immediate execution in a single step, preventing meaningful inspection and increasing the blast radius of a compromised installer. In a deployment guide, this pattern normalizes unsafe operator behavior and makes accidental or supply-chain compromise more likely.
Content: Scanner excerpt · references/deployment.md (reported line 7)May include surrounding context.
One-Liner (macOS/Linux)

bash
curl -fsSL https://openclaw.ai/install.sh | bash

npm (all platforms, requires Node 22+)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: This installation path again executes a remote script directly from curl, creating a supply-chain execution risk before the user can inspect the contents. The added git-install argument does not reduce the danger because the bootstrap script still has arbitrary execution capability.
Content: Scanner excerpt · references/deployment.md (reported line 18)May include surrounding context.
Git (hackable)

bash
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --install-method git cd openclaw && pnpm install && pnpm run build

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description says the skill is automatically invoked for essentially any OpenClaw-related topic, spanning installation, configuration, channels, memory, tools, hooks, deployment, and multi-agent setup. Such broad matching increases the chance of unintended activation, which can cause instruction interference, overbroad context injection, or the skill taking precedence in situations where narrower, safer handling would be more appropriate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says to use the skill whenever the user asks about a very large set of OpenClaw topics, ranging from installation to secrets, messaging platforms, camera, and deployment. It does not define narrower activation boundaries or exclusion conditions, so the invocation scope is ambiguous and could cause over-triggering in ordinary conversations that merely mention OpenClaw.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill presents installation and deployment commands that fetch code, install global packages, and start services without any safety warning or verification guidance. In an agent setting, this increases the risk that a user or downstream system will execute privileged operations too casually, especially when the commands affect local services and network-exposed components.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file includes multiple examples of setting bot tokens and notes local credential storage paths, such as Discord tokens and WhatsApp credentials, but it does not provide a warning about protecting secrets, avoiding shell history leakage, or securing the referenced credential files. Because this documentation can lead users to handle authentication material directly, a brief warning about secret exposure and local credential protection is warranted.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/configuration.md (reported line 35)May include surrounding context.
md
"models": { "providers": { "my-provider": { "baseUrl": "https://api.example.com/v1", "apiKey": "${CUSTOM_API_KEY}", "api": "openai-completions", // or "anthropic-messages" "models": [{ "id": "model-id", "contextWindow": 128000 }]

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The configuration example includes insecure defaults or example values for browser and sandbox controls, notably allowing private-network browser access, enabling code evaluation, disabling sandboxing, and granting a writable/non-read-only container profile without an adjacent warning. In operational documentation, such examples can normalize unsafe deployment patterns and lead users to expose internal services, enable code execution against sensitive environments, or run agents without meaningful isolation.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/deployment.md (reported line 46)May include surrounding context.
Linux (systemd user-level, recommended)

bash
openclaw gateway install sudo loginctl enable-linger $(whoami) # Enable lingering systemctl --user enable --now openclaw-gateway

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/deployment.md (reported line 52)May include surrounding context.
Linux (systemd user-level, recommended)

bash
openclaw gateway install sudo loginctl enable-linger $(whoami) # Enable lingering systemctl --user enable --now openclaw-gateway

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/deployment.md (reported line 53)May include surrounding context.
Linux (systemd user-level, recommended)

bash
openclaw gateway install sudo loginctl enable-linger $(whoami) # Enable lingering systemctl --user enable --now openclaw-gateway

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/deployment.md (reported line 101)May include surrounding context.
Linux (systemd user-level, recommended)

bash
openclaw gateway install sudo loginctl enable-linger $(whoami) # Enable lingering systemctl --user enable --now openclaw-gateway

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/deployment.md (reported line 47)May include surrounding context.
bash
openclaw gateway install sudo loginctl enable-linger $(whoami) # Enable lingering systemctl --user enable --now openclaw-gateway

Linux (system-wide)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/deployment.md (reported line 53)May include surrounding context.
Linux (system-wide)

bash
sudo openclaw gateway install --system sudo systemctl enable --now openclaw-gateway

Manual Foreground

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/deployment.md (reported line 137)May include surrounding context.
Fly.io

bash
fly apps create my-openclaw fly volumes create openclaw_data --size 1 --region iad fly secrets set OPENCLAW_GATEWAY_TOKEN=$(openssl rand -hex 32) fly secrets set ANTHROPIC_API_KEY=sk-ant-...

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The silent automatic memory flush persists conversation context to disk during compaction without user visibility, which creates a risk of covert retention of sensitive information. Because the flush is invisible to the user and occurs automatically, users may reasonably assume data was transient when it is actually being stored in long-term memory files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document describes an option to index session transcripts into memory search, which can persist and surface prior conversation content without clearly warning users about the privacy implications. In an agent platform context, transcripts may contain secrets, personal data, or sensitive operational details, so enabling this feature without prominent disclosure and consent can lead to unintended retention and retrieval of sensitive information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The broadcast groups feature causes multiple agents to process the same incoming message, but the documentation does not clearly warn that user content will be disclosed to every listed agent. Even if sessions and memory are isolated per agent, the original message is still replicated across agents, which can create unexpected privacy exposure, especially in personal or regulated chats.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The PDF tool documentation states that native mode sends raw PDF bytes directly to model providers, but it does not prominently warn users about the privacy and data-handling implications of transmitting full document contents to third-party services. In a tool reference for a platform handling secrets, documents, and automation, this omission can lead users to unknowingly expose sensitive PDFs such as contracts, IDs, financial records, or internal documents.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

SkillSpector

External Script Fetching

Chaining Abuse

External Script Fetching

One-Liner (macOS/Linux)

npm (all platforms, requires Node 22+)

Chaining Abuse

One-Liner (macOS/Linux)

npm (all platforms, requires Node 22+)

External Script Fetching

Git (hackable)

Rp1

Rp1

Vague Triggers

Vague Triggers

Missing User Warnings

Missing User Warnings

External Transmission

Missing User Warnings

Sudo/Root Execution

Linux (systemd user-level, recommended)

Sudo/Root Execution

Linux (systemd user-level, recommended)

Sudo/Root Execution

Linux (systemd user-level, recommended)

Sudo/Root Execution

Linux (systemd user-level, recommended)

Session Persistence

Linux (system-wide)

Session Persistence

Linux (system-wide)

Manual Foreground

Session Persistence

Fly.io

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Static analysis