ClawHub
Back to skill

Security audit

每日安全巡检

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OpenClaw security-check helper that performs read-only checks, runs official diagnostic commands, and saves a local report without evidence of hidden or destructive behavior.

Before installing, be aware that the skill will read OpenClaw configuration and may summarize security-relevant local findings into a saved report. Keep that report private, verify cron delivery destinations such as Telegram or Feishu yourself, and do not allow it to print secret values.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (17)

Credential Access

High
Category
Privilege Escalation
Content
### 2. 防火墙
（提醒用户在本机确认已开启）

### 3. API 密钥在 .env
（✅ 正常 / ❌ 发现明文 + 位置与建议）

### 4. SOUL.md 安全监控规则
Confidence
78% confidence
Finding
The skill directs the agent to check whether API keys exist in `.env`, which can require inspecting files that often contain live secrets. In a security-checking skill this is contextually understandable, but it is still sensitive because the agent may read or expose secret values, locations, or other credential-bearing content in the generated report if not carefully constrained.

Credential Access

High
Category
Privilege Escalation
Content
- 在报告中提醒用户在本机确认：**系统设置 → 网络 → 防火墙 → 开启**，并设置为「阻止所有传入连接」。
- 本项无法自动检测，仅作提醒。

## 3. API 密钥是否在 .env

- 检查 `openclaw.json` 中是否仍有明文 `apiKey`、`token`、`appSecret`（即非 `${VAR}` 形式的敏感值）。
- 若存在明文凭证，列出位置并建议迁移到 `.env` 并用 `${VAR}` 引用。
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
- 在报告中提醒用户在本机确认：**系统设置 → 网络 → 防火墙 → 开启**，并设置为「阻止所有传入连接」。
- 本项无法自动检测，仅作提醒。

## 3. API 密钥是否在 .env

- 检查 `openclaw.json` 中是否仍有明文 `apiKey`、`token`、`appSecret`（即非 `${VAR}` 形式的敏感值）。
- 若存在明文凭证，列出位置并建议迁移到 `.env` 并用 `${VAR}` 引用。
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
- 在报告中提醒用户在本机确认：**系统设置 → 网络 → 防火墙 → 开启**，并设置为「阻止所有传入连接」。
- 本项无法自动检测，仅作提醒。

## 3. API 密钥是否在 .env

- 检查 `openclaw.json` 中是否仍有明文 `apiKey`、`token`、`appSecret`（即非 `${VAR}` 形式的敏感值）。
- 若存在明文凭证，列出位置并建议迁移到 `.env` 并用 `${VAR}` 引用。
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
- 在报告中提醒用户在本机确认：**系统设置 → 网络 → 防火墙 → 开启**，并设置为「阻止所有传入连接」。
- 本项无法自动检测，仅作提醒。

## 3. API 密钥是否在 .env

- 检查 `openclaw.json` 中是否仍有明文 `apiKey`、`token`、`appSecret`（即非 `${VAR}` 形式的敏感值）。
- 若存在明文凭证，列出位置并建议迁移到 `.env` 并用 `${VAR}` 引用。
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
This markdown file is entirely Chinese-language instructional content, and it does not provide an opt-in, translation, or justification that the skill is region-specific. Under the policy criteria, forcing a specific language without user choice is a natural-language locale violation.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to write a report into `workspace/docs/security-audit/security-report-YYYY-MM-DD.md`, which is a filesystem modification. Because the skill does not require an explicit user opt-in or a clear warning before writing, it can cause unintended persistent changes when invoked by a user or scheduled task, especially in automation contexts where write side effects may be overlooked.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The skill mandates Simplified Chinese output for all executions, regardless of the user's language preference. While not a direct code-execution risk, forced language can degrade user comprehension of security findings, increasing the chance that warnings or remediation steps are misunderstood or missed in multilingual environments.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
- **配置项**：`security.sensitiveData.patterns`（如 `["sk-*"]`）过滤敏感输出。
- **凭证**：API Key / token 用环境变量或密钥管理器；不硬编码。
- **文件权限**：配置与凭证目录 `chmod 600`（文件）、`700`（目录）；`openclaw security audit --fix` 会协助收紧。

---
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The template explicitly instructs the agent to save a generated security report into `workspace/docs/security-audit/security-report-YYYY-MM-DD.md` without any user confirmation or warning that data will be written to disk. In a security-audit context, the report may contain sensitive configuration details, findings, or environment-related observations, so silent persistence increases the risk of unintended local data retention and later disclosure.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The phrase '按以下结构输出报告（简体中文）' mandates a specific language for the report. The policy allows locale constraints only when user choice or clear justification is provided, which is not present here.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The name, tagline, and description force a specific language/locale in user-facing natural language. Under the policy, language constraints should either offer a choice or be clearly documented as a justified region-specific limitation, which is not present here.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
This markdown file is natural-language guidance, and all user-facing instructions are presented only in Chinese. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in or clear justification.

Natural-Language Policy Violations

Low
Confidence
93% confidence
Finding
The natural-language entries in the changelog are presented only in Chinese, with no indication that this skill is intended solely for a Chinese-speaking audience or that users can choose a language. Under the policy, forcing a specific language without opt-in can be a locale-policy violation.

Missing User Warnings

Low
Confidence
91% confidence
Finding
This markdown file states that the skill can save a generated security report to `workspace/docs/security-audit/security-report-YYYY-MM-DD.md`, which affects user data on disk. The description does not include a clear caution or explicit user-facing warning about file creation/persistence, so users may not realize audit outputs will be stored locally.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
该文档将“官方文档”直接指向 `zh-CN` 本地化页面，未说明这是可选语言版本，也未提供其他语言入口。按规则，强制特定语言或地区而没有用户选择，属于自然语言层面的语言/locale 策略问题。

Natural-Language Policy Violations

Low
Confidence
80% confidence
Finding
The example invocation is written as a fixed Chinese phrase addressed to the AI, which can indicate a language-specific usage expectation. The file does not mention that other languages are acceptable or provide any user language choice, so it may conflict with a language/locale neutrality policy.

Static analysis

No suspicious patterns detected.