Openclaw Genie

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:22 AM UTC
• Version: 1.2.0

Overview

This is a coherent OpenClaw documentation skill, but it includes copyable high-impact install and deployment commands without enough safety guidance.

Review the install commands before using this skill. Prefer pinned package versions or verified release artifacts, avoid piping remote scripts directly into bash, do not run setup as root unless necessary, and be deliberate about enabling daemons, messaging tokens, memory/session indexing, browser private-network access, native PDF uploads, and system-wide services.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:26
• Finding: Unverified Remote Installation Script Executed Directly by Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:26`, `references/deployment.md:7`, and `references/deployment.md:18` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code `SKILL.md:26`: ```bash curl -fsSL https://openclaw.ai/install.sh | bash ``` `references/deployment.md:7`: ```bash curl -fsSL https://openclaw.ai/install.sh | bash ``` `references/deployment.md:18`: ```bash curl -fsSL https://openclaw.ai/install.sh | bash -s -- --install-method git ``` ### Technical Analysis These commands download content from a mutable external HTTPS endpoint and pass it directly to Bash. The script is not pinned to a release, checked against a cryptographic digest, verified with a trusted signature, or saved for inspection before execution. HTTPS protects the network connection under normal conditions, but it does not guarantee that the server will always return the same reviewed script. The effective payload may change after this Skill has been audited. Compromise of the website, hosting infrastructure, CDN, DNS configuration, TLS account, deployment pipeline, or upstream project could therefore turn the documented installation command into an arbitrary-code-execution channel. The use of `curl -f` and `-sS` only controls HTTP error handling and output behavior. It does not validate the integrity or authenticity of the downloaded script beyond ordinary TLS. ### Attack Path 1. An attacker compromises or gains control over `https://openclaw.ai/install.sh` or infrastructure capable of changing its response. 2. A user or an agent follows the installation instructions in this Skill. 3. `curl` retrieves the attacker-controlled response. 4. The shell pipe sends the response directly to Bash without an integrity check or review step. 5. Bash executes the payload with all permissions held by the invoking account. 6. The payload can modify user files, access user-readable secrets, install additional softwar ...[truncated 991 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every direct `curl | bash` installation command. 2. Publish versioned installation artifacts at immutable release URLs. 3. Download the installer to a local file before execution: ```bash curl -fL -o openclaw-install.sh "https://example.invalid/releases/vX.Y.Z/openclaw-install.sh" ``` 4. Publish the expected SHA-256 digest through a separately protected release channel and verify it before execution: ```bash printf '%s %s\n' "EXPECTED_SHA256" "openclaw-install.sh" | sha256sum --check - ``` 5. Prefer signing release artifacts with a documented signing key and require signature verification. 6. Allow users to inspect the downloaded file before explicitly invoking it: ```bash less openclaw-install.sh bash openclaw-install.sh ``` 7. Document that the installer must not be run as root unless a specific, reviewed installation step requires elevation. 8. Prefer a version-pinned package from a trusted registry when a package-manager installation method is available. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29
• Finding: Mutable and Unpinned Packages Are Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:29`, `references/deployment.md:12`, `README.md:38`, and `README.md:44` **Vulnerability Type**: Insecure dependency installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:29` and `references/deployment.md:12`: ```bash npm install -g openclaw@latest ``` `README.md:38`: ```bash npx skills add fcsouza/agent-skills --skill openclaw-genie ``` `README.md:44`: ```bash npx skills add fcsouza/agent-skills --skill openclaw-genie -g ``` ### Technical Analysis The npm installation explicitly selects the mutable `latest` distribution tag instead of a reviewed, exact version. The command can therefore install different code at different times while the documentation remains unchanged. Global installation increases the affected scope by placing the package in a shared executable environment. The `npx` commands also do not pin the invoked package to an exact version or integrity value. Depending on local state and npm configuration, `npx` can retrieve package code from a registry and execute its command-line entry point. Package lifecycle scripts and CLI initialization code may execute during this process. No evidence shows that the referenced packages are currently malicious. The vulnerability is the lack of reproducibility and integrity controls: a compromised maintainer account, registry release, distribution tag, or transitive dependency could cause these commands to retrieve and execute unreviewed code. ### Attack Path 1. An attacker compromises a relevant package maintainer or registry account, or introduces malicious code into a newly resolved release or dependency. 2. The attacker publishes the malicious version under the package's `latest` tag or otherwise causes the unpinned `npx` resolution to select it. 3. A user follows the Skill's installation instructions. 4. npm or npx downloads the mutable package and its dependency graph. 5. Installation lifecycle scripts or the downloaded ...[truncated 784 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace mutable tags such as `@latest` with an exact, reviewed version: ```bash npm install -g openclaw@X.Y.Z ``` 2. Pin the package used through `npx` to an exact version: ```bash npx skills@X.Y.Z add fcsouza/agent-skills --skill openclaw-genie ``` 3. Where supported, pin the skill source to an immutable commit or signed release rather than a moving repository branch. 4. Publish and verify package integrity metadata, checksums, provenance attestations, and release signatures. 5. Review package lifecycle scripts and use `--ignore-scripts` when installation scripts are not required. 6. Prefer project-local installation over global installation to reduce the affected scope and improve reproducibility. 7. Use lockfiles and automated dependency auditing for installations maintained as part of a deployment. 8. Do not run npm or npx with administrative privileges unless explicitly necessary and independently reviewed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (24)

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# One-liner install (macOS/Linux, requires Node 22+)
curl -fsSL https://openclaw.ai/install.sh | bash

# Or via npm
npm install -g openclaw@latest

• Confidence: 98% confidence
• Finding: `curl ... | bash` executes remote code immediately with no opportunity for review, integrity verification, or sandboxing. If the remote host, transport path, or served script is compromised, the user could run arbitrary attacker-controlled code on the local machine.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# One-liner install (macOS/Linux, requires Node 22+)
curl -fsSL https://openclaw.ai/install.sh | bash

# Or via npm
npm install -g openclaw@latest

• Confidence: 97% confidence
• Finding: The shell pipe into `bash` is a classic dangerous chaining pattern because it combines retrieval and execution into a single step, bypassing review and making accidental or automated unsafe execution more likely. In this skill context, it is especially risky because the content is framed as a quick-start recommendation that may be copied verbatim by users or automation.

External Script Fetching

High

• Category: Supply Chain

Content

### One-Liner (macOS/Linux)
```bash
curl -fsSL https://openclaw.ai/install.sh | bash
```

### npm (all platforms, requires Node 22+)

• Confidence: 99% confidence
• Finding: Piping a remotely fetched script directly into bash executes unreviewed code from the network with the user's privileges, making compromise possible if the host, TLS trust chain, DNS, or distribution pipeline is attacked. In deployment documentation, this is especially risky because users are encouraged to run it verbatim during installation.

Chaining Abuse

High

• Category: Tool Misuse

Content

### One-Liner (macOS/Linux)
```bash
curl -fsSL https://openclaw.ai/install.sh | bash
```

### npm (all platforms, requires Node 22+)

• Confidence: 98% confidence
• Finding: The shell pipeline from curl to bash is dangerous because it combines network retrieval and immediate execution in a single step, preventing meaningful inspection and increasing the blast radius of a compromised installer. In a deployment guide, this pattern normalizes unsafe operator behavior and makes accidental or supply-chain compromise more likely.

External Script Fetching

High

• Category: Supply Chain

Content

### Git (hackable)
```bash
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --install-method git
cd openclaw && pnpm install && pnpm run build
```

• Confidence: 99% confidence
• Finding: This installation path again executes a remote script directly from curl, creating a supply-chain execution risk before the user can inspect the contents. The added git-install argument does not reduce the danger because the bootstrap script still has arbitrary execution capability.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description says the skill is automatically invoked for essentially any OpenClaw-related topic, spanning installation, configuration, channels, memory, tools, hooks, deployment, and multi-agent setup. Such broad matching increases the chance of unintended activation, which can cause instruction interference, overbroad context injection, or the skill taking precedence in situations where narrower, safer handling would be more appropriate.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest says to use the skill whenever the user asks about a very large set of OpenClaw topics, ranging from installation to secrets, messaging platforms, camera, and deployment. It does not define narrower activation boundaries or exclusion conditions, so the invocation scope is ambiguous and could cause over-triggering in ordinary conversations that merely mention OpenClaw.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill presents installation and deployment commands that fetch code, install global packages, and start services without any safety warning or verification guidance. In an agent setting, this increases the risk that a user or downstream system will execute privileged operations too casually, especially when the commands affect local services and network-exposed components.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown file includes multiple examples of setting bot tokens and notes local credential storage paths, such as Discord tokens and WhatsApp credentials, but it does not provide a warning about protecting secrets, avoiding shell history leakage, or securing the referenced credential files. Because this documentation can lead users to handle authentication material directly, a brief warning about secret exposure and local credential protection is warranted.

External Transmission

Medium

• Category: Data Exfiltration

Content

"models": {
    "providers": {
      "my-provider": {
        "baseUrl": "https://api.example.com/v1",
        "apiKey": "${CUSTOM_API_KEY}",
        "api": "openai-completions",  // or "anthropic-messages"
        "models": [{ "id": "model-id", "contextWindow": 128000 }]

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The configuration example includes insecure defaults or example values for browser and sandbox controls, notably allowing private-network browser access, enabling code evaluation, disabling sandboxing, and granting a writable/non-read-only container profile without an adjacent warning. In operational documentation, such examples can normalize unsafe deployment patterns and lead users to expose internal services, enable code execution against sensitive environments, or run agents without meaningful isolation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Linux (systemd user-level, recommended)
```bash
openclaw gateway install
sudo loginctl enable-linger $(whoami)  # Enable lingering
systemctl --user enable --now openclaw-gateway
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Linux (systemd user-level, recommended)
```bash
openclaw gateway install
sudo loginctl enable-linger $(whoami)  # Enable lingering
systemctl --user enable --now openclaw-gateway
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Linux (systemd user-level, recommended)
```bash
openclaw gateway install
sudo loginctl enable-linger $(whoami)  # Enable lingering
systemctl --user enable --now openclaw-gateway
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Linux (systemd user-level, recommended)
```bash
openclaw gateway install
sudo loginctl enable-linger $(whoami)  # Enable lingering
systemctl --user enable --now openclaw-gateway
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
openclaw gateway install
sudo loginctl enable-linger $(whoami)  # Enable lingering
systemctl --user enable --now openclaw-gateway
```

### Linux (system-wide)

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Linux (system-wide)
```bash
sudo openclaw gateway install --system
sudo systemctl enable --now openclaw-gateway
```

### Manual Foreground

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Fly.io
```bash
fly apps create my-openclaw
fly volumes create openclaw_data --size 1 --region iad
fly secrets set OPENCLAW_GATEWAY_TOKEN=$(openssl rand -hex 32)
fly secrets set ANTHROPIC_API_KEY=sk-ant-...

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The silent automatic memory flush persists conversation context to disk during compaction without user visibility, which creates a risk of covert retention of sensitive information. Because the flush is invisible to the user and occurs automatically, users may reasonably assume data was transient when it is actually being stored in long-term memory files.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document describes an option to index session transcripts into memory search, which can persist and surface prior conversation content without clearly warning users about the privacy implications. In an agent platform context, transcripts may contain secrets, personal data, or sensitive operational details, so enabling this feature without prominent disclosure and consent can lead to unintended retention and retrieval of sensitive information.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The broadcast groups feature causes multiple agents to process the same incoming message, but the documentation does not clearly warn that user content will be disclosed to every listed agent. Even if sessions and memory are isolated per agent, the original message is still replicated across agents, which can create unexpected privacy exposure, especially in personal or regulated chats.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The PDF tool documentation states that native mode sends raw PDF bytes directly to model providers, but it does not prominently warn users about the privacy and data-handling implications of transmitting full document contents to third-party services. In a tool reference for a platform handling secrets, documents, and automation, this omission can lead users to unknowingly expose sensitive PDFs such as contracts, IDs, financial records, or internal documents.

Static analysis

No suspicious patterns detected.