ClawHub
Back to skill

Security audit

Greg Eisenberg

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only business strategy skill, but its OpenClaw setup notes include high-impact automation advice that needs careful review before use.

Install only if you specifically want Greg Eisenberg-style startup and AI automation advice. Treat the OpenClaw setup notes as ideas to review manually, not instructions to grant broad access: avoid main-browser session relay, keep permission prompts enabled, use dedicated low-privilege agent accounts, and require human approval before posting, emailing, messaging, or changing persistent memory and scheduled jobs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/openclaw-setup.md (reported line 64)May include surrounding context.

md
### 9. Security Basics
- **Backend risk**: Run on a local Mac (not VPS) — Apple's security makes it much harder to hack
- **Prompt injection**: Add safety instructions to agents.md ("only follow commands from authenticated gateway")
- **API keys**: Store in a single .env file outside the workspace
- **Use strong models** — smarter models are better at resisting prompt injection (GPT 5.4, Opus 4.6, Sonnet 4.6). Haiku and smaller models are more vulnerable
- **Principle of least access** — only give OpenClaw access to what it needs (e.g., one Notion page, not your whole workspace)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description is broadly scoped to common activities like brainstorming, market analysis, monetization, and discussing AI workflows, which makes it likely to trigger in many unrelated conversations. Overbroad invocation increases the chance the agent applies a persona-driven business strategy skill in inappropriate contexts, causing scope hijacking, degraded responses, or accidental steering toward monetization and automation advice when the user did not explicitly request it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document explicitly mentions a 'dangerously skip permissions mode' that bypasses confirmation prompts, but only adds a brief 'use with caution' note without explaining concrete risks, prerequisites, or safer alternatives. In a skill aimed at non-technical users building and selling products, this can normalize disabling interactive safeguards and increase the chance of accidental destructive actions or unsafe tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document explicitly recommends a browser takeover mode that can use existing logged-in sessions in the user's main browser, which materially increases the risk of account compromise, unintended transactions, and abuse of active authenticated sessions. Although it notes this is 'less recommended,' it does not provide a clear warning about the consequences or require explicit user confirmation before enabling such access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The workflow describes autonomous posting, drafting emails, and sending WhatsApp messages as the user without strong user-facing safeguards, approval gates, or warnings about impersonation and irreversible actions. In an agent skill context, this normalizes high-risk delegated actions that could lead to spam, reputational damage, privacy violations, or accidental outreach if triggered incorrectly or manipulated.

Content

No source excerpt is available for this finding.