ClawSecCheck — OpenClaw Security Self-Audit

• Outcome: Review
• Latest audit: Aug 6, 2026 · 3:22 PM UTC
• Version: 3.61.0

Overview

This is a broad local OpenClaw security audit skill whose sensitive reads and limited writes are mostly disclosed and aligned with its purpose.

Install only if you want a comprehensive local security audit and are comfortable with it reading OpenClaw files, agent logs/session metadata, installed skill text, host security posture signals, credential-store path existence, and ClawHub token-store presence/permissions. Treat generated reports as private because they can map sensitive local security metadata, and use `--no-history`, `--no-host`, `--no-native`, `--no-sockets`, or `--no-deptree` when you want narrower scope.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares broad capabilities in its behavior despite having no explicit permissions model: it reads configs, logs, installed skills, host files, token-store configs, writes local history/report files, and instructs the agent to run external commands and update checks. That mismatch is dangerous because users and orchestrators may treat it as lower-risk than it is, leading to overbroad data access and unintended side effects under a 'safe/read-only' label.

Description-Behavior Mismatch

Medium

• Confidence: 82% confidence
• Finding: The manifest repeatedly claims the scanner makes no network calls, but the guided flow tells the host agent to perform an online version check/update workflow on user request. Even if indirect, this is still a security-relevant capability escalation because the skill can induce networked actions while presenting itself as offline-only, which weakens operator trust and review assumptions.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill markets itself as reports-only, but it also directs local state changes such as monitoring snapshots/history writes and ignore-file proposal/application workflows. This inconsistency is dangerous because users may consent to the skill under a non-mutating assumption while it actually causes persistence and modifies local audit suppression state.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The boundary section says the skill will never generate or suggest remediation, yet elsewhere it instructs suggesting ignore proposals to reduce findings. Suggesting suppressions can materially change what future audits surface, so this is effectively a remediation/workflow-change path disguised as non-remediation guidance.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The text says 'ClawSecCheck reports; it never changes anything,' but other sections authorize monitoring writes and ignore-file modifications. Conflicting assurances around mutability are risky because they can socially engineer operators into approving a skill with broader write behavior than they expect.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This code explicitly searches for and evaluates ClawHub CLI token stores outside the advertised OpenClaw self-audit surface. Even though it tries not to print token values, it expands the skill's data-access scope to external publish-capable credentials and filesystem locations a user would not reasonably infer from the manifest, which is a real overcollection/privacy issue for a local audit tool.

Description-Behavior Mismatch

Low

• Confidence: 76% confidence
• Finding: The skill inspects Codex-specific per-agent home data under agents/*/agent/codex-home, which is broader than the manifest's stated OpenClaw config/bootstrap/log/skills scope. This is read-only and used for security checks, so the impact is limited, but it still represents undisclosed collection of adjacent tool data.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code inventories ClawHub publish-capable credentials and their permissions, which is broader than a narrow OpenClaw self-audit and touches a high-value adjacent secret domain. Because such tokens can publish skill updates, merely accessing their storage materially increases the sensitivity of what the skill reads, even if the token content is not echoed.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The report module performs host-level credential-surface enumeration by inspecting environment variable names and probing for the existence of .env files, keychains, browser cookie stores, SSH material, and cloud auth configuration. Even without reading file contents, this exceeds pure rendering and broadens data collection into sensitive host inventory, which can expose privacy/security-relevant metadata in reports or downstream JSON/HTML outputs.

Context-Inappropriate Capability

High

• Confidence: 91% confidence
• Finding: This renderer emits copy-pasteable shell command sequences, including destructive cleanup commands like rm -rf against a target-derived path. Although it uses quoting and some control-character refusal, generating executable command plans from report/advice code creates a prompt-injection and operator-misuse hazard: a user or host agent may run destructive commands based on rendered output rather than a safer structured action flow.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This section explicitly turns a nominally local, read-only auditing skill into an agent-orchestrated workflow that may fetch third-party content and run generated shell commands outside the tool itself. Even though the docs include some safety constraints, they still instruct the host agent to perform risky acquisition and execution steps, increasing prompt-injection, supply-chain, and command-handling exposure beyond the stated scanner boundary.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The guidance tells the assistant to inspect services, processes, and kernel modules on the host, which exceeds the stated local config-audit role and expands the skill into host reconnaissance. While framed as read-only probing, it still encourages environmental discovery that may be sensitive and unnecessary for a documentation-driven skill.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The activation examples include broad phrases like 'security check' and 'audit me,' which can collide with ordinary conversation and trigger a highly invasive audit flow. Because this skill reads configs, logs, installed skills, and some host-security artifacts, accidental invocation increases the chance of unnecessary sensitive data exposure and unintended local writes.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The code reads environment variables that can point to ClawHub config/token-store locations, but this capability is not clearly user-disclosed in the skill description. While it does not directly read token-valued env vars here, consulting sensitive path overrides can reveal and expand access to credential-bearing files beyond expected scope.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation presents shell probing commands for host-monitor discovery without an adjacent requirement for user confirmation, despite these being live host commands the assistant is told to run on its own. That creates a consent and scope-control gap, especially in environments where even read-only host inspection is sensitive.

Credential Access

High

• Category: Privilege Escalation

Content

dotenv_hits: list[str] = []
    if home_path is not None and home_path.exists():
        candidates = [home_path / ".env", home_path / ".envrc"]
        for ws in WORKSPACE_DIRS:
            candidates.append(home_path / ws / ".env")
            candidates.append(home_path / ws / ".envrc")

• Confidence: 93% confidence
• Finding: The code probes for .env and .envrc files under the user's home and workspace directories and records their presence as credential reachability evidence. This is sensitive host-secret inventory outside pure report rendering and can reveal where secret material exists, increasing exposure if reports are shared or consumed by other tools.

Credential Access

High

• Category: Privilege Escalation

Content

if home_path is not None and home_path.exists():
        candidates = [home_path / ".env", home_path / ".envrc"]
        for ws in WORKSPACE_DIRS:
            candidates.append(home_path / ws / ".env")
            candidates.append(home_path / ws / ".envrc")
        for cand in candidates:
            if cand.is_file():  # path-existence check only — never reads contents

• Confidence: 93% confidence
• Finding: This loop checks candidate .env/.envrc paths and appends hits to report evidence, effectively mapping secret-bearing files on the host. Even though contents are not read, confirming the existence and relative location of secret stores is sensitive information that can aid an attacker or leak privacy if exported.

Credential Access

High

• Category: Privilege Escalation

Content

for cand in candidates:
            if cand.is_file():  # path-existence check only — never reads contents
                dotenv_hits.append(_rel(cand))
    entries.append({"class": ".env", "reachable": bool(dotenv_hits), "evidence": dotenv_hits})

    keychain_hits: list[str] = []
    if home_path is not None and home_path.exists():

• Confidence: 92% confidence
• Finding: The resulting inventory explicitly labels the .env class as reachable and stores evidence of discovered files, turning report output into a map of likely secret locations. In a tool designed to produce shareable artifacts, this kind of metadata collection should be tightly scoped and consented.

Credential Access

High

• Category: Privilege Escalation

Content

dotenv_hits.append(_rel(cand))
    entries.append({"class": ".env", "reachable": bool(dotenv_hits), "evidence": dotenv_hits})

    keychain_hits: list[str] = []
    if home_path is not None and home_path.exists():
        for rel in (
            "Library/Keychains",

• Confidence: 94% confidence
• Finding: The code enumerates keychain-related storage locations under the user's home directory as part of the credential surface map. Discovering and reporting the presence of keyrings/keychains broadens the tool into host secret reconnaissance, which is sensitive even without reading contents.

Credential Access

High

• Category: Privilege Escalation

Content

keychain_hits: list[str] = []
    if home_path is not None and home_path.exists():
        for rel in (
            "Library/Keychains",
            ".local/share/keyrings",
            ".gnupg",
        ):

• Confidence: 94% confidence
• Finding: This specific keychain path probe contributes to identifying sensitive credential stores on the host. Such inventory is more dangerous than ordinary config inspection because it reveals where protected secrets may reside and may exceed user expectations for a report module.

Credential Access

High

• Category: Privilege Escalation

Content

if home_path is not None and home_path.exists():
        for rel in (
            "Library/Keychains",
            ".local/share/keyrings",
            ".gnupg",
        ):
            p = home_path / rel

• Confidence: 94% confidence
• Finding: The code checks for keyring directories and records hits, which creates sensitive environmental metadata about credential storage. In context, this expands beyond OpenClaw-specific analysis and can make resulting artifacts more revealing than necessary.

Credential Access

High

• Category: Privilege Escalation

Content

):
            p = home_path / rel
            if p.exists():  # path-existence check only — never reads contents
                keychain_hits.append(_rel(p))
    entries.append({"class": "keychain", "reachable": bool(keychain_hits), "evidence": keychain_hits})

    cookie_hits: list[str] = []

• Confidence: 94% confidence
• Finding: The existence check and evidence append for keychain paths operationalizes host credential-store inventory. While useful diagnostically, it increases sensitivity of collected data and creates unnecessary exposure if the output leaves the local machine.

Credential Access

High

• Category: Privilege Escalation

Content

p = home_path / rel
            if p.exists():  # path-existence check only — never reads contents
                keychain_hits.append(_rel(p))
    entries.append({"class": "keychain", "reachable": bool(keychain_hits), "evidence": keychain_hits})

    cookie_hits: list[str] = []
    if home_path is not None and home_path.exists():

• Confidence: 94% confidence
• Finding: This line emits a keychain reachability entry into the report structure, making host secret-store presence part of machine-readable output. That turns a local audit artifact into sensitive reconnaissance data if later copied, shared, or ingested elsewhere.

Credential Access

High

• Category: Privilege Escalation

Content

p = home_path / rel
            if p.exists():  # path-existence check only — never reads contents
                keychain_hits.append(_rel(p))
    entries.append({"class": "keychain", "reachable": bool(keychain_hits), "evidence": keychain_hits})

    cookie_hits: list[str] = []
    if home_path is not None and home_path.exists():

• Confidence: 94% confidence
• Finding: This line emits a keychain reachability entry into the report structure, making host secret-store presence part of machine-readable output. That turns a local audit artifact into sensitive reconnaissance data if later copied, shared, or ingested elsewhere.

Credential Access

High

• Category: Privilege Escalation

Content

p = home_path / rel
            if p.exists():  # path-existence check only — never reads contents
                keychain_hits.append(_rel(p))
    entries.append({"class": "keychain", "reachable": bool(keychain_hits), "evidence": keychain_hits})

    cookie_hits: list[str] = []
    if home_path is not None and home_path.exists():

• Confidence: 94% confidence
• Finding: This line emits a keychain reachability entry into the report structure, making host secret-store presence part of machine-readable output. That turns a local audit artifact into sensitive reconnaissance data if later copied, shared, or ingested elsewhere.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: clawseccheck/checks/_vet.py:3710

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: clawseccheck/risk.py:1777

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: clawseccheck/skillast.py:1274

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: clawseccheck/catalog.py:1652

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: clawseccheck/checks/_content.py:14257

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: clawseccheck/checks/_lifecycle.py:1730

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: clawseccheck/checks/_vet.py:3710

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: clawseccheck/skillast.py:1274

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: clawseccheck/checks/_content.py:8668

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: clawseccheck/checks/_lifecycle.py:4273

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: clawseccheck/risk.py:1753

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: clawseccheck/checks/_content.py:13429

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: clawseccheck/checks/_mcp.py:4330