ClawHub
Back to skill

Security audit

每日安全巡检

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OpenClaw security-check helper that performs read-only checks, runs official diagnostic commands, and saves a local report without evidence of hidden or destructive behavior.

Before installing, be aware that the skill will read OpenClaw configuration and may summarize security-relevant local findings into a saved report. Keep that report private, verify cron delivery destinations such as Telegram or Feishu yourself, and do not allow it to print secret values.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (17)

Credential Access

High
Category
Privilege Escalation
Confidence
78% confidence
Finding

The skill directs the agent to check whether API keys exist in .env, which can require inspecting files that often contain live secrets. In a security-checking skill this is contextually understandable, but it is still sensitive because the agent may read or expose secret values, locations, or other credential-bearing content in the generated report if not carefully constrained.

Content

Scanner excerpt · assets/report-template.md (reported line 14)May include surrounding context.

md
### 2. 防火墙
（提醒用户在本机确认已开启）

### 3. API 密钥在 .env
（✅ 正常 / ❌ 发现明文 + 位置与建议）

### 4. SOUL.md 安全监控规则

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/source-article-security-config.md (reported line 52)May include surrounding context.

md
- 在报告中提醒用户在本机确认：**系统设置 → 网络 → 防火墙 → 开启**，并设置为「阻止所有传入连接」。
- 本项无法自动检测，仅作提醒。

## 3. API 密钥是否在 .env

- 检查 `openclaw.json` 中是否仍有明文 `apiKey`、`token`、`appSecret`（即非 `${VAR}` 形式的敏感值）。
- 若存在明文凭证，列出位置并建议迁移到 `.env` 并用 `${VAR}` 引用。

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/source-article-security-config.md (reported line 66)May include surrounding context.

md
- 在报告中提醒用户在本机确认：**系统设置 → 网络 → 防火墙 → 开启**，并设置为「阻止所有传入连接」。
- 本项无法自动检测，仅作提醒。

## 3. API 密钥是否在 .env

- 检查 `openclaw.json` 中是否仍有明文 `apiKey`、`token`、`appSecret`（即非 `${VAR}` 形式的敏感值）。
- 若存在明文凭证，列出位置并建议迁移到 `.env` 并用 `${VAR}` 引用。

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/source-article-security-config.md (reported line 79)May include surrounding context.

md
- 在报告中提醒用户在本机确认：**系统设置 → 网络 → 防火墙 → 开启**，并设置为「阻止所有传入连接」。
- 本项无法自动检测，仅作提醒。

## 3. API 密钥是否在 .env

- 检查 `openclaw.json` 中是否仍有明文 `apiKey`、`token`、`appSecret`（即非 `${VAR}` 形式的敏感值）。
- 若存在明文凭证，列出位置并建议迁移到 `.env` 并用 `${VAR}` 引用。

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/CHECKLIST.md (reported line 15)May include surrounding context.

md
- 在报告中提醒用户在本机确认：**系统设置 → 网络 → 防火墙 → 开启**，并设置为「阻止所有传入连接」。
- 本项无法自动检测，仅作提醒。

## 3. API 密钥是否在 .env

- 检查 `openclaw.json` 中是否仍有明文 `apiKey`、`token`、`appSecret`（即非 `${VAR}` 形式的敏感值）。
- 若存在明文凭证，列出位置并建议迁移到 `.env` 并用 `${VAR}` 引用。

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file is entirely Chinese-language instructional content, and it does not provide an opt-in, translation, or justification that the skill is region-specific. Under the policy criteria, forcing a specific language without user choice is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs the agent to write a report into workspace/docs/security-audit/security-report-YYYY-MM-DD.md, which is a filesystem modification. Because the skill does not require an explicit user opt-in or a clear warning before writing, it can cause unintended persistent changes when invoked by a user or scheduled task, especially in automation contexts where write side effects may be overlooked.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill mandates Simplified Chinese output for all executions, regardless of the user's language preference. While not a direct code-execution risk, forced language can degrade user comprehension of security findings, increasing the chance that warnings or remediation steps are misunderstood or missed in multilingual environments.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · assets/community-official-security-extras.md (reported line 54)May include surrounding context.

md
- **配置项**：`security.sensitiveData.patterns`（如 `["sk-*"]`）过滤敏感输出。
- **凭证**：API Key / token 用环境变量或密钥管理器；不硬编码。
- **文件权限**：配置与凭证目录 `chmod 600`（文件）、`700`（目录）；`openclaw security audit --fix` 会协助收紧。

---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The template explicitly instructs the agent to save a generated security report into workspace/docs/security-audit/security-report-YYYY-MM-DD.md without any user confirmation or warning that data will be written to disk. In a security-audit context, the report may contain sensitive configuration details, findings, or environment-related observations, so silent persistence increases the risk of unintended local data retention and later disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The phrase '按以下结构输出报告（简体中文）' mandates a specific language for the report. The policy allows locale constraints only when user choice or clear justification is provided, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The name, tagline, and description force a specific language/locale in user-facing natural language. Under the policy, language constraints should either offer a choice or be clearly documented as a justified region-specific limitation, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file is natural-language guidance, and all user-facing instructions are presented only in Chinese. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The natural-language entries in the changelog are presented only in Chinese, with no indication that this skill is intended solely for a Chinese-speaking audience or that users can choose a language. Under the policy, forcing a specific language without opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file states that the skill can save a generated security report to workspace/docs/security-audit/security-report-YYYY-MM-DD.md, which affects user data on disk. The description does not include a clear caution or explicit user-facing warning about file creation/persistence, so users may not realize audit outputs will be stored locally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

该文档将“官方文档”直接指向 zh-CN 本地化页面，未说明这是可选语言版本，也未提供其他语言入口。按规则，强制特定语言或地区而没有用户选择，属于自然语言层面的语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The example invocation is written as a fixed Chinese phrase addressed to the AI, which can indicate a language-specific usage expectation. The file does not mention that other languages are acceptable or provide any user language choice, so it may conflict with a language/locale neutrality policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.