OpenClaw Auto-Doctor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:13 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent OpenClaw troubleshooting assistant, but it gives an agent broad automatic repair powers with weak confirmation, privacy, and scoping controls.

Review this skill carefully before installing. Use it only in a disposable or tightly scoped OpenClaw workspace, disable full automatic repair, require approval for every command or PR, avoid administrator privileges, and redact logs before any external search.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:50

Finding

Untrusted External Repair Guidance May Lead to Arbitrary Command Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50-85
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Excerpt

markdown

Search the following channels in priority order:

1. Local solution database
2. GitHub Issues
3. GitHub Pull Requests
4. OpenClaw community
5. Official documentation

Repair strategy:

| Error type | Repair method |
| Dependency missing | Execute npm install / pip install, etc. |
| Configuration error | Modify configuration files |
| Permission problem | Repair file/directory permissions |
| Service not started | Start the related service |
| Code bug | Generate a patch file |

The excerpt is an English translation of the corresponding Skill instructions.

Technical Analysis

The Skill directs the agent to search external sources and then apply discovered solutions through commands, patches, configuration changes, permission changes, or service operations. It does not require:

• Treating remote content as untrusted data.
• Verifying the provenance or integrity of a proposed command.
• Restricting commands to a reviewed allowlist.
• Rejecting shell operators, command substitutions, or privilege-elevation requests.
• Executing repairs in a sandbox.
• Limiting filesystem access to an approved project directory.

Search results from GitHub issues, pull requests, forums, or documentation can contain attacker-controlled text. If the agent interprets that text as operational instructions, a malicious repair recommendation could become an arbitrary local command.

This is not direct remote payload retrieval by code in the package; instead, it is an unsafe trust boundary between externally sourced advice and privileged agent tool execution.

Attack Path

1. An attacker publishes a GitHub issue, forum post, or other indexed page containing an error message that matches a likely OpenClaw failure.
2. The attacker presents a malicious shell command or patch as a purported solut ...[truncated 1065 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every search result, issue body, forum post, and retrieved patch as untrusted data.
2. Never execute externally suggested commands automatically.
3. Display the exact command, working directory, environment changes, and affected files before execution.
4. Require explicit user approval for every command originating from an external source.
5. Enforce a structured command allowlist rather than passing free-form text to a shell.
6. Reject shell metacharacters, redirections, command substitutions, pipelines, and privilege-elevation commands unless separately reviewed.
7. Execute diagnostics and proposed repairs in an isolated sandbox with network, filesystem, and process restrictions.
8. Permit writes only inside an explicitly approved workspace.
9. Validate patches for unexpected file paths, symlinks, generated binaries, hooks, and credential access.
10. Record the source URL, content hash, approved command, execution result, and rollback result in an audit log.

T08 · Insecure Dependencies

Warning

• Location: SPEC.md:97

Finding

Unpinned Package Installation Exposes the Host to Supply-Chain Attacks

Content

View full analysis

Vulnerability Details

File Location: SPEC.md, lines 97-108
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Excerpt

yaml

- pattern: "Cannot find module.*node_modules"
  solution: "Run npm install to reinstall dependencies"
  fix_command: "npm install"
  source: "community"

- pattern: "Connection refused.*6379"
  solution: "The Redis service is not running; start Redis"
  fix_command: "brew services start redis"
  source: "github_issue_123"

The translated excerpt preserves the commands and configuration structure from the specification. Related instructions also permit pip install and environment-level dependency installation.

Technical Analysis

The repair model permits package-manager execution without requiring exact dependency versions, trusted registries, integrity hashes, lockfile enforcement, package-name verification, or lifecycle-script restrictions.

Package managers may execute installation hooks with the same privileges as the agent. An error message or external recommendation can influence which package is installed. This creates exposure to:

• Typosquatting.
• Dependency confusion.
• Compromised package releases.
• Malicious package installation scripts.
• Unexpected dependency upgrades caused by an unconstrained install.
• Registry substitution or configuration poisoning.

Even a generic npm install can execute lifecycle scripts from dependencies and can resolve versions differently when lockfiles are missing, modified, or ignored.

Attack Path

1. An attacker causes or advertises an error that appears to identify a missing dependency.
2. A malicious or similarly named package is published to a registry accessible to the host.
3. The Skill diagnoses the error as a missing dependency.
4. The agent runs npm install, pip install, or an externally recommended package-installation command without a pinned version and verified integrity.
5. The package manager downloads the at ...[truncated 802 chars]

Remediation

View remediation

Remediation Suggestions

1. Allow installation only for explicitly approved package names from trusted registries.
2. Require exact versions and verified integrity hashes.
3. Enforce existing lockfiles with immutable or frozen-lockfile modes.
4. Reject dependency installation when the lockfile is absent or unexpectedly modified.
5. Disable package lifecycle scripts by default and permit them only after review.
6. Check package ownership, publication history, signatures, and registry origin before installation.
7. Prevent dependency confusion by using scoped package names and authenticated private registries where appropriate.
8. Run package installation in an isolated, non-privileged environment.
9. Generate a dependency diff and require user approval before changing manifests or lockfiles.
10. Scan newly resolved dependencies and preserve an auditable software bill of materials.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SPEC.md:259

Finding

Fully Automatic Repair Mode Permits Broad and Potentially Privileged System Changes

Content

View full analysis

Vulnerability Details

File Location: SPEC.md, lines 259-267
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation, T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Excerpt

yaml

github:
  repository: openclaw/openclaw
  token: ${GITHUB_TOKEN}  # Read from an environment variable

auto_fix:
  enabled: true
  require_confirmation: false  # Fully automatic mode
  backup_before_fix: true
  max_auto_fixes_per_day: 20

Related repair instructions in SKILL.md lines 72-85 permit configuration modification, permission repair, service startup, dependency installation, and code patching. SKILL.md line 217 also states that some repairs may require administrator privileges.

Technical Analysis

The configuration explicitly supports disabling confirmation while enabling automatic repair. The available repair operations include changes to code, configuration, permissions, dependencies, environment settings, and services.

The documentation does not establish mandatory controls for:

• Privilege elevation.
• Protected operating-system paths.
• Permission or ownership changes.
• Service-management operations.
• Repository credentials and pull-request publication.
• Maximum filesystem or process scope.
• Mandatory review of destructive commands.
• Separation between diagnosis and remediation privileges.

Backups and post-repair validation do not prevent unauthorized execution. A backup may also be incomplete, inaccessible, or affected by the same operation. Moreover, the project contains only documentation, so there is no implementation demonstrating that backup, validation, or rollback guarantees are enforced.

Attack Path

1. The operator enables automatic repair with require_confirmation: false.
2. An attacker-controlled log entry, misleading error, poisoned solution entry, or incorrect diagnosis maps to a repair action.
3. The agent selects a repair involving permissions, configuration, package instal ...[truncated 1207 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove fully automatic mode for security-sensitive actions.
2. Require explicit approval for package installation, service management, permission changes, ownership changes, configuration edits, credential use, and privilege elevation.
3. Run diagnosis under a read-only, non-privileged account.
4. Use a separate narrowly scoped remediation component rather than granting the diagnostic agent broad system access.
5. Restrict writes to an operator-approved workspace and deny access to system directories by default.
6. Prohibit sudo, administrator shells, and equivalent elevation unless the user approves a specific, fully displayed command.
7. Apply policy checks to every proposed file path, process action, and permission change.
8. Require a complete diff and rollback plan before changing code or configuration.
9. Store backups outside the modified target and verify that restoration succeeds before proceeding.
10. Limit GitHub credentials to the minimum repository and pull-request permissions required; never expose token values in logs or prompts.
11. Add rate limits, change-size limits, protected-file rules, and an emergency stop mechanism.
12. Ensure post-repair validation cannot itself execute untrusted project hooks or scripts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly supports automatic fixes, dependency installation, permission changes, service startup, configuration edits, and PR creation, but the high-level description does not consistently and prominently warn that it may modify files, alter system state, or contact external services like GitHub. This is dangerous because users may invoke the skill expecting analysis only, while the workflow includes operations with meaningful integrity, availability, and data exposure risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description and all example invocations are written in Chinese, including trigger phrases such as '请监控 OpenClaw 日志' and '分析 OpenClaw 错误'. There is no indication that users may interact in other languages or that the skill is intentionally limited to a Chinese-speaking context, which creates a language/locale policy concern.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: openclaw-auto-doctor
description: 实时监控 OpenClaw 日志，自动诊断错误，搜索解决方案，并自动修复问题或创建 Pull Request
version: 1.0.0
model: sonnet
---

# OpenClaw Auto-Doctor

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is broad enough that routine discussion of OpenClaw errors or problems could invoke a skill that reads logs, searches external services, and proposes or performs fixes. In this skill’s context, over-triggering is risky because the downstream actions can expose sensitive log data and lead to file or system modifications without sufficiently narrow scoping.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The design sends log-derived error data to external services such as GitHub, community forums, and Stack Overflow, but does not warn that logs and stack traces may contain secrets, tokens, file paths, internal code context, or customer data. This creates a realistic risk of unintended data exfiltration during automated troubleshooting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The specification explicitly enables fully automatic fixes with require_confirmation: false, while the skill is designed to modify code, configuration, and environment state and even create PRs. That combination can cause unauthorized or unsafe changes, supply-chain affecting commands, and cascading outages if the diagnosis or fetched solution is wrong.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language instructions and example interactions are entirely in Chinese, with no indication that users may choose another language. This can violate language/locale policy when a skill implicitly forces one language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language instructions and section content are presented in Chinese, but the document does not indicate that this locale is optional or justified as region-specific. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.