Auto-Diagnostic (Tianyi)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:13 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned diagnostic documentation, but it needs review because it can expose tokens and perform local repairs without consistently requiring explicit approval.

Install only if you are comfortable with an agent reading OpenClaw logs and configuration and potentially changing OpenClaw settings, restarting services, installing the browser extension, or stopping processes. Before using it, require diagnosis-only behavior by default, approve each repair command separately, and do not allow full tokens to be printed in chat or logs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:180

Finding

Diagnostic workflow may expose gateway authentication tokens in agent output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:180-197
Vulnerability Type: Plaintext credential disclosure
Risk Level: Medium

Vulnerable Source Excerpt

The following is an English translation of the complete source segment:

text

Example:

[Diagnostic Result]
Issue: Chrome extension connection failed with a red exclamation mark
Root cause: The gateway token is empty, and the token entered in the extension does not match

[Executed]
Updated gateway.auth.token = "tianyi2026"
Restarted the gateway service

[User Action Required]
1. Enter this token in the extension options: tianyi2026
2. Save the settings and reconnect

[Prevention]
Synchronize the extension configuration after changing the token

Related instructions at references/error-patterns.md:13-17 direct the agent to retrieve and inspect the configured token:

text

1. Read the configuration and expand the gateway property.
2. Confirm the value of gateway.auth.token.
3. Enter the same token in the extension options.
4. If the configuration is empty, add a token and restart the gateway.

Technical Analysis

The diagnostic process treats gateway.auth.token as ordinary diagnostic data and demonstrates reproducing its plaintext value in the generated report. Authentication secrets should not be returned in conversational output, logs, screenshots, or diagnostic histories.

Because the skill instructs an AI agent to read ~\.openclaw\openclaw.json, the model may ingest other sensitive configuration values as well. The output template does not require redaction, masking, local-only comparison, or confirmation that the requester is authorized to view the token.

The literal value shown in the example may only be illustrative, so it is not established as a live credential. Nevertheless, the demonstrated behavior encourages unsafe plaintext handling of real tokens.

Attack Path

1. An attacker or unauthori ...[truncated 995 chars]

Remediation

View remediation

Remediation Suggestions

1. Prohibit disclosure of complete token values in all diagnostic output.
2. Mask secrets consistently, for example by displaying only the final four characters.
3. Compare tokens locally and report only whether they match.
4. Do not load the complete configuration into model context when a narrowly scoped parser can retrieve only non-secret metadata.
5. Require protected user input for token changes rather than asking users to paste credentials into chat.
6. Replace examples containing plaintext token values with placeholders such as [REDACTED].
7. Ensure diagnostic history and logs apply secret-detection and redaction controls.
8. If a token may already have been disclosed, rotate it and invalidate the previous value.
9. Generate replacement tokens with a cryptographically secure random generator rather than using predictable examples.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:160

Finding

Broad automatic triggers can lead to sensitive inspection and unauthorized system modification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:160-168
Vulnerability Type: Insufficient authorization and overly broad activation conditions
Risk Level: Medium

Vulnerable Source Excerpt

The following is an English translation of the complete source segment:

text

## Trigger Conditions

Trigger this skill in the following situations:

- The user reports "connection failed," "cannot use," or "an error occurred"
- The keywords unauthorized, failed, or error are detected
- A service status check returns an exception
- Configuration validation fails
- Consecutive failures occur in the skill invocation chain

Once triggered, SKILL.md:25-28 instructs the agent to read logs and configuration:

text

1. Collect context:
   - Read relevant logs: \tmp\openclaw\openclaw-*.log
   - Check service status: openclaw gateway status, openclaw browser status
   - Read the configuration file: ~\.openclaw\openclaw.json

The repair stage at SKILL.md:49-61 permits direct configuration changes, service restarts, and extension installation:

powershell

$config = Get-Content ~\.openclaw\openclaw.json -Raw
$config | Set-Content ~\.openclaw\openclaw.json
openclaw gateway restart

openclaw browser extension install

A port-conflict remedy at SKILL.md:148-158 also recommends forced process termination:

powershell

Stop-Process -Id XXXXX -Force

Technical Analysis

Generic words such as error, failed, and unauthorized are not reliable indicators that a privileged diagnostic or repair workflow is appropriate. Such words can appear in untrusted logs, web content, tool output, or unrelated user messages.

After activation, the workflow may access a credential-bearing configuration file and progress to configuration writes, extension installation, gateway restarts, or forced process termination. SKILL.md does not establish a mandatory approval boundary between re ...[truncated 2189 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user invocation before accessing logs or configuration.
2. Separate diagnosis into a strictly read-only phase and place every mutating action behind a distinct confirmation prompt.
3. Present the exact command, target, expected effect, and rollback procedure before requesting approval.
4. Do not activate privileged workflows solely from generic keywords in untrusted content.
5. Treat log entries, status output, filenames, process identifiers, and suggested commands as untrusted data rather than instructions.
6. Read only the minimum necessary configuration fields and exclude secret values from model context.
7. Create a backup and validate syntax before replacing configuration files; use atomic writes to prevent corruption.
8. Before terminating a process, verify its executable path, owner, command line, listening port, start time, and association with the expected OpenClaw service.
9. Prefer graceful service-specific shutdown commands over Stop-Process -Force.
10. Require separate approval for extension installation and display the verified source and integrity information.
11. Reconcile SKILL.md with the README so that authorization requirements are explicit and mandatory in the operative instructions.
12. Add a dry-run mode and record an auditable approval event for each state-changing operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough to activate on common words like 'failed', 'error', or generic user complaints, which can cause the skill to run in many ordinary contexts. Because the skill includes repair behavior such as config changes and service restarts, over-triggering materially raises the risk of unnecessary or harmful actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Most operational instructions, triggers, and outputs are written in Chinese, with no indication that the user can choose another language. This creates a language-policy issue because the skill appears to force a specific language without documented user opt-in or a justified locale limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow describes changing configuration and restarting services without a prominent upfront warning that the skill may alter local state. In a diagnostic skill, users may reasonably expect observation rather than mutation, so this omission increases the risk of surprise changes, disruption, and unsafe automation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The example output includes revealing a gateway token directly in the response and instructing the user to reuse it, which exposes a secret in user-facing text and potentially logs, chat history, or screenshots. Credential disclosure can enable unauthorized access to the gateway and is especially risky because the token is presented as part of a normal remediation flow.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The security/privacy section claims the skill is effectively read-only with respect to logs, but the documented workflow explicitly includes modifying configuration files and restarting services. This inconsistency can mislead users and downstream agents about the scope of side effects, reducing informed consent and increasing the chance that impactful actions are taken under false assumptions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trust statement says configuration changes require explicit authorization, but the main workflow and examples show direct config edits and command execution without a confirmation gate. This discrepancy is dangerous because it conditions users or orchestration systems to trust the skill's assurances while it operationally enables unauthorized changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file provides the command Stop-Process -Id 22916 -Force, which forcibly kills a process, but does not warn the user that it may terminate the wrong process or cause unsaved state loss. For markdown files, destructive or system-affecting behaviors should be accompanied by a user-facing warning about potential impact.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README presents all user-facing instructions and descriptions in Chinese only, with no indication that other languages are supported or that the language is intentionally region-scoped. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill documentation forces a specific language presentation without offering the user a language or locale option. Under the policy rule, language-specific content should either provide user choice or clearly justify the locale constraint.

Content

No source excerpt is available for this finding.