Security audit

ClawSecCheck — OpenClaw Security Self-Audit

Security checks for vulnerabilities and agentic risk

Overview

Its local audits fit its purpose, but the optional package-vetting workflow can run untrusted package code before checking it.

Avoid the PyPI pre-download workflow until it uses non-executing downloads or a real sandbox. The local audit reads sensitive logs and credential-store contents and keeps its own local history; review that scope before running it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+3 more)

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: clawseccheck/checks/_mcp.py:1494

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: clawseccheck/checks/_vet.py:6825

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: clawseccheck/dossier.py:472

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: clawseccheck/skillast.py:2275

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: clawseccheck/adjudication/_builder.py:180

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: clawseccheck/catalog.py:1947

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: clawseccheck/checks/_content.py:17805

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: clawseccheck/shippedexec.py:1

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: clawseccheck/skillast.py:8194

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: clawseccheck/checks/_config.py:2165

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: clawseccheck/checks/_content.py:11515

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: clawseccheck/checks/_lifecycle.py:7920

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: clawseccheck/checks/_mcp.py:9908

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: clawseccheck/risk.py:2509

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: clawseccheck/checks/_content.py:16490

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: clawseccheck/checks/_mcp.py:7451

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: docs/USAGE.md:1