Security audit

Openclaw Smart Search

Security checks for vulnerabilities and agentic risk

Overview

This search skill matches its general purpose, but it includes serious credential-handling and setup risks that users should review before installing.

Review before installing. Avoid running quick-config.sh, rotate any bundled or previously exposed provider credentials, do not store OPENCLAW_MASTER_KEY in shell startup files, and prefer a restricted secret store or a 0600-only file. Treat setup:bailian as a persistent external tool configuration and pin or review the MCP server version before using it.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/quick-config.sh:17
Finding: Hardcoded Search Provider API Credentials in a Distributed Script
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup-wizard.ts:75
Finding: Master Encryption Key Written to a Plaintext File Without Explicit Restrictive Permissions
Content: View full analysis
.env ``` ### Technical Analysis The master key that protects all stored provider credentials is saved in plaintext inside the project directory. Neither implementation explicitly applies mode `0600`. The TypeScript call relies on the process umask. On common systems with umask `0022`, a newly created file can receive mode `0644`, allowing other local users to read it. Shell redirection has the same problem. Possession of both `.env` and `~/.openclaw/secrets/smart-search.json.enc` is sufficient to derive the AES key and decrypt every configured provider credential. AES-256-GCM and PBKDF2 do not mitigate disclosure of the master secret itself. The wizard also overwrites `.env` rather than safely updating only the required variable. This may replace existing configuration and can make an existing encrypted credential store unavailable if it was encrypted under a different key. ### Attack Path 1. A victim runs `npm run setup` or `scripts/quick-config.sh`. 2. The script creates `.env` using the user's default umask. 3. On a multi-user host with permissive defaults, another local account reads the project `.env`. 4. The attacker obtains `OPENCLAW_MA ...[truncated 667 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/search.sh:35
Finding: Shell Wrapper Executes the Contents of the Configuration File
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/manage-keys.ts:47
Finding: Key Management Command Prints Complete Decrypted API Keys
Content: View full analysis
'); console.error('Engines: bailian, tavily, serper, exa, firecrawl'); process.exit(1); } const key = await secretManager.getEngineKey(args[0]); console.log(key); break; ``` The duplicate CLI in `src/key-manager.ts` similarly prints the full value: ```typescript const key = await secretManager.getEngineKey(args[0]); console.log(`${args[0]}: ${key}`); ``` ### Technical Analysis The `key:get` operation decrypts a provider credential and writes the complete secret to standard output. Terminal recording, CI logs, shell command capture, remote session logging, process supervisors, and copied diagnostic output can retain the value indefinitely. This behavior conflicts with the documentation's broad statement that API keys are not logged. Although the user explicitly invokes a retrieval command, displaying the full secret is not required for normal search operation and creates an avoidable disclosure path. The separate status command also displays a partial key preview. Even partial values should be reviewed because provider-specific prefixes and suffixes can aid correlation, although the complete disclosure in `key:get` is the primary issue. ### Attack Path 1. A user or automation invokes `npm run key:get `. 2. The script decrypts the selected credential. 3. The complete credential is emitted to standard output. 4. A terminal recorder, CI system, logging wrapper, support transcript, or nearby observer captures the output. 5. A person with access to that output reuses the credential directly against the provider. ### Impact Assessment Anyone able to read the captured ou ...[truncated 335 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup-bailian.ts:155
Finding: Bailian Setup Prints the Complete Master Encryption Key to the Terminal
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/setup-bailian.ts:116
Finding: Unpinned Package Is Configured for Automatic Execution Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (199)

Known Vulnerable Dependency: handlebars==4.7.8 — 8 advisory(ies): CVE-2026-33916 (Handlebars.js has Prototype Pollution Leading to XSS through Partial Template In); CVE-2026-33937 (Handlebars.js has JavaScript Injection via AST Type Confusion); CVE-2026-33938 (Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @part) +5 more

Critical

Category: Supply Chain
Confidence: 93% confidence
Finding: handlebars 4.7.8 has multiple serious advisories, including prototype pollution and potential code or script injection vectors when compiling or rendering attacker-controlled templates. Although this lockfile suggests it is brought in transitively by ts-jest as a development dependency, templating vulnerabilities are high risk because CI, scaffolding, or code-generation paths may process external content and can become an execution or injection boundary.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The guide tells users to extract a master key directly from .env into an environment variable via shell command substitution. This increases exposure of a decryption secret to the shell environment and process context, making accidental disclosure more likely through shell history, process inspection in some setups, or inherited environments.
Content: Scanner excerpt · CONFIG_AND_TEST.md (reported line 53)May include surrounding context.
bash
cd ~/.agents/skills/openclaw-smart-search export OPENCLAW_MASTER_KEY=$(grep OPENCLAW_MASTER_KEY .env | cut -d'=' -f2) echo "✅ 主密钥已加载（${#OPENCLAW_MASTER_KEY}字符）"

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: This troubleshooting step again instructs users to load the master key from .env into an environment variable, unnecessarily broadening the secret's exposure. Repeating the pattern in troubleshooting guidance makes unsafe handling more likely and normalizes insecure operational practice.
Content: Scanner excerpt · CONFIG_AND_TEST.md (reported line 253)May include surrounding context.
解决：

bash
export OPENCLAW_MASTER_KEY=$(grep OPENCLAW_MASTER_KEY .env | cut -d'=' -f2)

永久生效：

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: Appending the master key export into ~/.bashrc creates persistence of a sensitive secret in plaintext within a shell startup file. This materially worsens risk because the key becomes long-lived, automatically loaded into every shell session, and more likely to be exposed via backups, dotfile sync, local compromise, or accidental sharing.
Content: Scanner excerpt · CONFIG_AND_TEST.md (reported line 258)May include surrounding context.
永久生效：

bash
echo 'export OPENCLAW_MASTER_KEY="'$(grep OPENCLAW_MASTER_KEY .env | cut -d'=' -f2)'"' >> ~/.bashrc source ~/.bashrc

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · CONFIG_AND_TEST.md (reported line 258)May include surrounding context.
pm run key:get tavily

text
### 重新配置 API Keys ```bash npm run setup

生成新主密钥

bash
npm run key:generate-master

❓ 常见问题

Q1: OPENCLAW_MASTER_KEY 未设置

问题：

text
❌ OPENCLAW_MASTER_KEY 未设置

解决：

bash
export OPENCLAW_MASTER_KEY=$(grep OPENCLAW_MASTER_KEY .env | cut -d'=' -f2)

永久生效：

bash
echo 'export OPENCLAW_MASTER_KEY="'$(grep OPENCLAW_MASTER_KEY .env | cut -d'=' -f2)'"' >> ~/.bashrc source ~/.bashrc

Q2: API Key 未配置

问题：

text
未配置 API Key。请运行：npm run setup

解决：

bash
npm run setup

交互式输入至少一个引擎的 API Key。

Q3: 解密失败

问题：

text
Salt not found in config file

解决：

bash
# 重新生成配置文件 node test-config.js # 重新配置 API Keys npm run setup

Q4: 引擎调用失败

问题：

text
[Bailian] API Error: 401 Unauthorized

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation describes a benign search-aggregation skill, but the content repeatedly indicates broader behaviors: secret collection, key import/export, local filesystem writes, environment inspection, and shell-based diagnostics. This mismatch is security-relevant because users and orchestrators may grant trust or permissions based on the declared purpose while the skill performs materially more sensitive operations.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T03 · Remote Payload Retrieval and Execution

SkillSpector

Credential Access

Credential Access

Credential Access

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

生成新主密钥

❓ 常见问题

Q1: OPENCLAW_MASTER_KEY 未设置

Q2: API Key 未配置

Q3: 解密失败

Q4: 引擎调用失败

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4