OpenClaw Collaboration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:14 AM UTC
• Version: 1.1.0

Overview

This OpenClaw collaboration skill is mostly disclosed, but it gives broad instructions for persistent memory writes, configuration changes, gateway restarts, log access, and possible external message delivery.

Install only if you intend to let the assistant help administer a local OpenClaw setup, not just coordinate tasks. Keep use read-only by default, require explicit human approval before any workspace write, config edit, gateway restart, log inspection, or Feishu delivery, and back up ~/.openclaw before using the maintenance guidance.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:83

Finding

Cross-Agent Workspace Memory Access and Persistent State Modification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:83-85
Vulnerability Type: Cross-Agent memory access and modification
Risk Level: Medium

Vulnerable Excerpt

The following is an English translation of the audited documentation:

text

Hermes can read memory files in the OpenClaw workspace directory.
- When Hermes writes an entry, append a [Hermes] marker to its end.
- Avoid writing to the same file concurrently: Hermes writes to projects/
  and decisions/, while OpenClaw writes daily logs.

The workspace path is also explicitly identified at SKILL.md:74:

text

Workspace: ~/.openclaw/workspace/

Technical Analysis

The Skill grants one Agent access to another Agent's persistent workspace and expressly permits writes to project and decision memory. Appending a [Hermes] marker provides attribution but does not enforce authorization, validate content, or prevent malicious instructions from being placed into persistent state.

If OpenClaw consumes these files in later sessions, attacker-controlled entries could affect future decisions or expose sensitive historical context. The documentation recommends read-only use and human confirmation, but these are advisory controls rather than technically enforced restrictions.

Attack Path

1. An attacker supplies a task that causes Hermes to inspect OpenClaw workspace files.
2. Hermes reads sensitive context from ~/.openclaw/workspace/.
3. The attacker asks Hermes to add an entry to projects/ or decisions/.
4. Hermes writes attacker-controlled content and appends the required marker.
5. OpenClaw later loads the modified persistent state.
6. The injected content influences subsequent sessions or decisions.

Impact Assessment

Successful exploitation could disclose stored conversations, project data, operational decisions, or other workspace content available to the executing user. Write access could corrupt persistent sta ...[truncated 161 chars]

Remediation

View remediation

Remediation Suggestions

• Make workspace access read-only by default and enforce it through filesystem permissions or sandbox policy.
• Permit access only to an explicit allowlist of non-sensitive files.
• Prohibit writes to files automatically loaded as Agent memory or behavioral state.
• Require per-file human approval before any persistent modification.
• Validate written content against a restrictive schema and reject embedded instructions.
• Use atomic writes, file locking, integrity hashes, and immutable audit logs.
• Store collaboration data in a separate exchange directory rather than an Agent's primary memory directory.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:156

Finding

Overly Broad Configuration, Log, Process, and Gateway Administration Capabilities

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:156-158
Vulnerability Type: Excessive system-management privileges
Risk Level: Medium

Vulnerable Excerpt

The following is an English translation preserving the documented commands:

bash

# Inspect processes
ps aux | grep openclaw-gateway

# Read the gateway error log
tail ~/.openclaw/logs/gateway.err.log

# Restart by killing the old process and starting a new gateway
kill <old-process>
openclaw gateway --port 18789

Related capabilities are documented at SKILL.md:18-20 and SKILL.md:131, including modification of system configuration files, gateway restart, direct JSON editing, and use of openclaw doctor --fix.

Technical Analysis

The Skill's collaboration purpose is combined with process enumeration, log access, configuration mutation, process termination, and service restart guidance. These operations exceed the minimum privileges necessary for routine Agent collaboration.

The instruction to kill an “old process” does not define a reliable PID-selection or identity-validation procedure. A process selected through broad process listing and text matching could be misidentified. Direct configuration editing also lacks schema validation, atomic replacement, ownership checks, and rollback enforcement.

Although the document warns users and recommends confirmation, it does not impose technical access controls or approval gates.

Attack Path

1. An attacker submits a maintenance or troubleshooting request.
2. The Agent enumerates processes and reads gateway logs.
3. Sensitive data present in logs becomes available to the Agent or requester.
4. The Agent directly modifies ~/.openclaw/openclaw.json or invokes an automated repair operation.
5. The Agent identifies and kills a gateway process without a robust identity check.
6. The gateway is restarted with modified, incomplete, or attacker-influenced settings.
7. Exist ...[truncated 568 chars]

Remediation

View remediation

Remediation Suggestions

• Move administrative operations into a separate, explicitly enabled maintenance Skill.
• Enforce human approval before reading logs, changing configuration, terminating processes, or restarting services.
• Use a service manager with a fixed service identity instead of process-list parsing and manual kill.
• Confirm executable path, process owner, PID, and start time before any termination.
• Redact credentials, tokens, personal data, and message content from logs before Agent access.
• Back up configuration and validate it against a strict schema before atomic replacement.
• Run diagnostics in read-only mode where possible and provide tested rollback procedures.
• Execute collaboration tasks under a least-privileged account unable to administer the gateway.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:107

Finding

Potential Unauthorized Delivery of Agent-Generated Content to Feishu

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:107-114
Vulnerability Type: Uncontrolled external message delivery
Risk Level: Medium

Vulnerable Excerpt

The audited section warns against delivery but still documents an actionable command:

bash

openclaw agent --agent main --message "<task>" --deliver --reply-channel feishu

It also states that --deliver should be avoided because it may send unauthorized messages and that the operation requires additional authorization.

Technical Analysis

The --deliver option changes an internal Agent invocation into an outbound communication operation. The documented command identifies a channel type but does not enforce a recipient allowlist, message preview, sensitive-data redaction, or a human approval step.

A warning is useful documentation but is not an access-control boundary. If the invoking environment already contains valid Feishu integration credentials, generated content could be transmitted using those credentials.

Attack Path

1. An attacker provides a task containing sensitive context or asks the Agent to summarize local data.
2. The Agent processes the request and produces a response.
3. The documented command is invoked with --deliver and the Feishu reply channel.
4. The response is sent through the configured integration without recipient and content validation.
5. Sensitive or unauthorized content reaches an external messaging destination.

Impact Assessment

Exploitation could result in unauthorized external communication, accidental disclosure of workspace information, or messages being sent under the identity of the configured OpenClaw integration. The practical scope depends on the permissions and destination configuration of the existing Feishu credentials. No hardcoded Feishu credentials were found in the audited project.

Remediation

View remediation

Remediation Suggestions

• Remove outbound delivery commands from the default collaboration workflow.
• Require explicit human confirmation immediately before every external transmission.
• Display the exact destination and final message content during confirmation.
• Restrict delivery to an allowlist of approved channels and recipients.
• Apply secret detection and sensitive-data redaction before transmission.
• Separate message-generation permission from message-delivery permission.
• Record the requesting identity, destination, content hash, approval, and delivery result in an immutable audit log.
• Use integration credentials with the minimum channel and recipient permissions required.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is presented as a collaboration and memory/API coordination guide, but it also documents higher-risk capabilities including configuration edits, service restarts, and external message delivery. That mismatch can cause users or calling agents to underestimate the operational scope and authorize actions they would not expect from the manifest description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents the skill description, warnings, and operational guidance entirely in Chinese, including the main description and all usage instructions. Because the file does not offer an alternative language or indicate that Chinese is a justified locale-specific requirement, it may violate a language/locale policy that requires user choice or explicit opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The section is labeled as read-only, but it explicitly allows Hermes to write markers into memory files. This contradiction can bypass policy assumptions, confuse downstream enforcement, and lead an operator or agent to perform writes in a mode that was expected to be non-mutating.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.