Self-Upgrade (Tianyi)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:13 AM UTC
• Version: 1.0.0

Overview

This self-maintenance skill is not plainly malicious, but it can change OpenClaw authentication configuration with weak user controls and unreliable rollback guidance.

Review this skill carefully before installing. Use only dry-run or manually supervised execution, back up `~/.openclaw/openclaw.json` yourself, do not rely on the documented `-RollbackTo` command unless it is implemented, and avoid allowing automatic repair or migration of authentication settings without seeing the exact diff first.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:93

Finding

Configuration Mutation and Repair Execution Bypass the Documented Confirmation Policy

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 93-100 and 134-140
Vulnerability Type: Automatic execution of medium-risk configuration changes
Risk Level: Medium

Vulnerable Code

powershell

param(
    [switch]$Auto,      # 自动模式（低风险操作）
    [switch]$DryRun,    # 仅预览，不执行
    [string]$BackupDir = "~\.openclaw\backups"
)

$ErrorActionPreference = "Stop"
$ConfigPath = "~\.openclaw\openclaw.json"

powershell

# 4. 保存变更
if ($migrated -and -not $DryRun) {
    $config | ConvertTo-Json -Depth 10 | Set-Content $ConfigPath
    Write-Host "[OK] Config updated" -ForegroundColor Green
    
    # 验证
    openclaw doctor --fix
}

Technical Analysis

The script declares an $Auto switch but never evaluates it. Consequently, omitting -DryRun is sufficient to authorize both a configuration rewrite and execution of openclaw doctor --fix.

This contradicts the skill's documented risk policy, which classifies configuration field updates as medium risk and states that they require user confirmation. The --fix command is also a mutation-oriented operation rather than a read-only validation step. Its complete effects are not constrained or reviewed by the shown script.

Although the code appears as an embedded script example in SKILL.md rather than as a standalone executable file, an agent or user following the skill would perform these operations with the privileges of the invoking OpenClaw process.

Attack Path

1. A legacy gateway.authToken field is present in ~\.openclaw\openclaw.json.
2. An agent or user invokes the documented script without -DryRun, but without explicitly selecting or approving an automatic mutation mode.
3. The migration sets $migrated to true.
4. The script serializes and overwrites the configuration file.
5. It then invokes openclaw doctor --fix, which may perform additional repairs not individually confirmed by the user.
6. The OpenClaw environment is altered despite the documented requirement fo ...[truncated 526 chars]

Remediation

View remediation

Remediation Suggestions

1. Require an explicit authorization switch before performing any mutation:

powershell

if (-not $DryRun -and -not $Auto) {
    throw "Configuration changes require explicit confirmation or -Auto."
}

2. Do not permit $Auto to authorize medium-risk changes unless the documented policy is revised and the user explicitly opts into that behavior.
3. Separate validation from repair. Run a read-only diagnostic first, display the proposed repairs, and request confirmation before invoking openclaw doctor --fix.
4. Present a change diff containing all fields that will be added, changed, or removed.
5. Validate the generated configuration against the documented schema before replacing the active file.
6. Check the exit status and postconditions of every repair operation, and automatically restore the backup if validation fails.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:125

Finding

Authentication Migration Overwrites the Existing Authentication Object

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 125-136
Vulnerability Type: Destructive configuration migration
Risk Level: Medium

Vulnerable Code

powershell

if ($config.gateway.authToken) {
    Write-Host "[MIGRATE] gateway.authToken → gateway.auth.token" -ForegroundColor Yellow
    if (-not $DryRun) {
        $config.gateway.auth = @{ token = $config.gateway.authToken }
        $config.gateway.PSObject.Properties.Remove('authToken')
        $migrated = $true
    }
}

# 4. 保存变更
if ($migrated -and -not $DryRun) {
    $config | ConvertTo-Json -Depth 10 | Set-Content $ConfigPath

Technical Analysis

The assignment below replaces the entire existing gateway.auth object with a new hashtable containing only token:

powershell

$config.gateway.auth = @{ token = $config.gateway.authToken }

If gateway.auth already contains properties such as an authentication mode, provider settings, certificate references, access restrictions, or other schema-defined values, those properties are discarded during serialization.

The migration also removes the legacy field before verifying that the resulting configuration is semantically valid. A backup is created earlier, but automatic backup creation does not prevent service disruption, and the documented rollback interface is not implemented by the shown script.

Attack Path

1. The configuration contains both a legacy gateway.authToken property and an existing gateway.auth object with additional properties.
2. The migration condition evaluates to true.
3. The script replaces the complete gateway.auth object with { token = <legacy token> }.
4. It removes gateway.authToken.
5. Set-Content persists the reduced object to the active configuration file.
6. Existing authentication settings are lost, potentially causing an authentication failure or changing the intended security behavior.

No external attacker-controlled input path is established in the audited file. E ...[truncated 597 chars]

Remediation

View remediation

Remediation Suggestions

1. Preserve the existing authentication object and update only its token property.
2. Create gateway.auth only when it does not already exist:

powershell

if (-not $config.gateway.auth) {
    $config.gateway | Add-Member -MemberType NoteProperty -Name auth -Value ([PSCustomObject]@{})
}

if ($config.gateway.auth.PSObject.Properties['token']) {
    $config.gateway.auth.token = $config.gateway.authToken
} else {
    $config.gateway.auth |
        Add-Member -MemberType NoteProperty -Name token -Value $config.gateway.authToken
}

3. Detect conflicts when both the legacy token and the new token exist. Do not overwrite a different new token without explicit user approval.
4. Validate the full migrated object against the configuration schema before removing gateway.authToken.
5. Write the result to a temporary file, validate it, and then perform an atomic replacement of the active configuration.
6. Run a read-only post-migration authentication and configuration check. Restore the backup automatically if validation fails.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:229

Finding

Advertised Rollback Command Uses an Undefined Parameter

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 93-99 and 229-234
Vulnerability Type: Nonfunctional recovery mechanism
Risk Level: Medium

Vulnerable Code

The documented parameter block does not define RollbackTo:

powershell

param(
    [switch]$Auto,      # 自动模式（低风险操作）
    [switch]$DryRun,    # 仅预览，不执行
    [string]$BackupDir = "~\.openclaw\backups"
)

$ErrorActionPreference = "Stop"

The rollback section nevertheless instructs users to supply that undefined parameter:

powershell

# 回滚到指定备份
.\self-upgrade.ps1 -RollbackTo "20260226-213000"

Technical Analysis

PowerShell advanced script parameter binding rejects named parameters that are not declared by the script. The shown implementation declares only Auto, DryRun, and BackupDir, while the documented recovery command uses RollbackTo.

As a result, the advertised rollback command cannot invoke a rollback path in the shown script. This creates a false assurance that automatic changes are recoverable through the documented interface.

The inconsistency is particularly significant because the skill states that all automatic changes must support rollback and because the same script rewrites authentication configuration.

Attack Path

1. The documented migration or repair operation changes the active OpenClaw configuration.
2. Validation fails, authentication is disrupted, or the service no longer starts correctly.
3. The user invokes the documented command: .\self-upgrade.ps1 -RollbackTo "20260226-213000".
4. PowerShell rejects -RollbackTo because it is not declared in the parameter block.
5. The damaged configuration remains active until the user manually identifies a backup and restores it.

This issue does not independently provide an attacker with additional privileges. It increases the duration and operational impact of failures caused by the other configuration mutations.

Impact Assessment

The affected scope is recovery of the invoking use ...[truncated 281 chars]

Remediation

View remediation

Remediation Suggestions

1. Implement a declared and validated rollback parameter:

powershell

param(
    [switch]$Auto,
    [switch]$DryRun,
    [string]$BackupDir = "~\.openclaw\backups",
    [string]$RollbackTo
)

2. Resolve the requested backup exclusively within the configured backup directory and reject path traversal or arbitrary filesystem paths.
3. Verify that the selected backup exists, is regular JSON, and conforms to the expected schema.
4. Back up the current configuration before restoring an older version.
5. Restore through a temporary file and atomic replacement, then run read-only validation.
6. If rollback is not implemented, remove the unsupported command and document a tested manual Copy-Item recovery procedure instead.
7. Add automated tests that create a backup, mutate the configuration, execute rollback, and compare the restored file with the original.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script enumerates a hard-coded path outside the user's home/OpenClaw configuration scope, which can expose information about another workspace or operate on an unintended installation context. In a self-upgrade skill, this is especially risky because users may trust it to act only on their local instance, but the hard-coded external path breaks that boundary and can cause information disclosure or accidental interaction with unrelated files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger conditions are broad and underspecified, such as periodic maintenance and failure conditions, which can cause the self-upgrade skill to run unexpectedly or too often. Because this skill can modify configuration, install dependencies, and run repair commands, ambiguous activation materially increases the chance of unintended state changes without sufficiently scoped user intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation promises a rollback parameter that the provided script does not implement, creating a false sense of recoverability for destructive or state-changing operations. In an upgrade skill that performs backups and configuration changes, users may proceed assuming rollback exists, and failure to restore can worsen outage or misconfiguration impact after a bad change.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.