OpenClaw Security Check

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:42 AM UTC
• Version: 1.0.0

Overview

This security-check skill has a coherent purpose, but its bundled audit script can execute attacker-controlled Python from a crafted OpenClaw config and can falsely report important checks as safe.

Do not install this version for unattended heartbeat or cron use. If you still test it manually, run it as a low-privilege user, review openclaw.json for unusual channel names first, do not rely on PASS results for firewall, SSH, or token strength, and treat any sudo remediation commands as separate manual administration steps after backups and access checks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/security-check.sh:105

Finding

Arbitrary Python Code Execution Through Unsanitized Channel Names

Content

View full analysis

/dev/null || echo ""; } ``` ### Technical Analysis Channel names originate in `openclaw.json` and are inserted between single quotes inside expressions supplied to `python3 -c`. No Python-string escaping or validation is applied. A channel key containing a quote and additional Python syntax can terminate the intended string literal and alter the expression executed by Python. Although the shell variable is enclosed in double quotes and does not directly produce shell metacharacter expansion, the resulting value is deliberately interpreted as Python source. This creates an arbitrary Python execution primitive for anyone able to influence the local OpenClaw configuration. ### Attack Path 1. An attack ...[truncated 1085 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/security-check.sh:209

Finding

Inactive UFW Firewall Is Incorrectly Reported as Active

Content

View full analysis

/dev/null; then fw_status=$(sudo ufw status 2>/dev/null | head -1 || echo "unknown") if echo "$fw_status" | grep -qi "active"; then check8_status=$(pass) check8_detail="UFW active" check8_severity="" else check8_status=$(fail) check8_detail="UFW installed but inactive" check8_severity="HIGH" fi ``` ### Technical Analysis The firewall state is tested using a case-insensitive substring search for `active`. Standard UFW output for a disabled firewall is: ```text Status: inactive ``` The word `inactive` contains the substring `active`, so `grep -qi "active"` succeeds. Consequently, both `Status: active` and `Status: inactive` can cause the script to report `PASS`. This is a fail-open validation error in a security audit: an explicitly disabled firewall is represented to the user as enabled. ### Attack Path 1. UFW is installed on the audited host but is inactive. 2. The audit invokes `sudo ufw status`. 3. UFW returns `Status: inactive`. 4. The substring search finds `active` inside `inactive`. 5. The firewall check is marked `PASS` and the report states `UFW active`. 6. The user or automation relies on the false result and does not enable or remediate the firewall. No separate attacker-controlled input is required. An attacker benefits when services are already exposed on a host whose operator relies on this audit. ### Impact Assessment The defect can conceal the absence of host firewall protection. Network services that operators believe are filtered may remain reachable from untrusted networks. The precise impact depends on listening services and upstream controls, but it can increase exposure to unauthorized access, service exploitation, credential attacks, and reconnaissance. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/security-check.sh:72

Finding

Predictable Authentication Tokens Pass the Token Strength Check

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/security-check.sh:300

Finding

Unescaped Configuration Data Produces Invalid or Injectable JSON Reports

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/security-check.sh:238

Finding

SSH Hardening Check Ignores Effective Configuration and Can Falsely Pass

Content

View full analysis

/dev/null | awk '{print $2}' || echo "unknown") root_login=$(grep -E "^PermitRootLogin" "$sshd_config" 2>/dev/null | awk '{print $2}' || echo "unknown") issues="" [[ "$pw_auth" == "yes" ]] && issues="${issues}PasswordAuth=yes " [[ "$root_login" == "yes" ]] && issues="${issues}RootLogin=yes " if [[ -z "$issues" ]]; then check9_status=$(pass) check9_detail="PasswordAuth=${pw_auth:-default} RootLogin=${root_login:-default}" check9_severity="" else check9_status=$(warn) check9_detail="$issues— recommend disabling" check9_severity="MEDIUM" fi ``` ### Technical Analysis The script searches only for exact, uncommented directives beginning in column one of `/etc/ssh/sshd_config`. It does not account for: - Leading whitespace. - `Include` directives and files such as `/etc/ssh/sshd_config.d/*.conf`. - Multiple directives and ordering semantics. - Conditional `Match` blocks. - Effective defaults selected by the installed SSH version. - Context-dependent settings for a particular user, host, or address. If no matching line is found, the variable is empty and no issue is appended. The check then reports `PASS`, even though the effective configuration may permit password authentication or root login. ### Attack Path 1. The host enables a risky SSH setting through an included file, a directive with leading whitespace, a conditional block, or an applicable default. 2. The main configuration file remains readable but contains no exact line matching the script's regular expressions. 3. Both extracted values are empty or incomplete. 4. The `issues` variable remains empty. 5. The audit re ...[truncated 709 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code substantially matches the declared security-audit purpose: it reads OpenClaw config, checks gateway exposure, auth mode, token strength, DM/group policies, file permissions, plaintext secrets, firewall, SSH hardening, and listening ports, then emits a 10-item structured report. However, the description explicitly advertises an optional auto-fix capability, while the script states 'No modifications — read-only audit' and contains no remediation logic. That is a meaningful description-to-behavior mismatch. A smaller gap is that the 'exposed ports' check is implemented as a simple count of non-loopback listening TCP ports rather than a fuller exposure analysis. Overall, the primary purpose aligns, but the undeveloped auto-fix claim makes the description not fully accurate.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak sudo sed -i 's/^#PasswordAuthentication ./PasswordAuthentication no/' /etc/ssh/sshd_config sudo sed -i 's/^#PermitRootLogin ./PermitRootLogin no/' /etc/ssh/sshd_config sudo sshd -t && sudo systemctl reload ssh

text

CRITICAL: Ensure key-based SSH access works in a separate session before closing current one.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The listed triggers include generic phrases like "run a security check," "am I secure?," and "check security settings," plus activation on periodic heartbeat/cron, without clear scope boundaries or negative examples. These phrases are broad enough to overlap with general security discussions rather than specifically targeting OpenClaw deployment audits.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

#6 Config Permissions → FAIL/WARN:

bash

chmod 600 ~/.openclaw/openclaw.json

#7 Plaintext Secrets → WARN:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

#8 Host Firewall → FAIL:

bash

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
# IMPORTANT: Allow SSH before enabling!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

#8 Host Firewall → FAIL:

bash

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
# IMPORTANT: Allow SSH before enabling!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

#8 Host Firewall → FAIL:

bash

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
# IMPORTANT: Allow SSH before enabling!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

#8 Host Firewall → FAIL:

bash

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
# IMPORTANT: Allow SSH before enabling!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

#8 Host Firewall → FAIL:

bash

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
# IMPORTANT: Allow SSH before enabling!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

#8 Host Firewall → FAIL:

bash

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
# IMPORTANT: Allow SSH before enabling!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

#8 Host Firewall → FAIL:

bash

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
# IMPORTANT: Allow SSH before enabling!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

#8 Host Firewall → FAIL:

bash

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
# IMPORTANT: Allow SSH before enabling!

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

#8 Host Firewall → FAIL:

bash

sudo apt install ufw -y
sudo ufw default deny incoming
sudo ufw default allow outgoing
# IMPORTANT: Allow SSH before enabling!

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The header claims the script is 'read-only' and makes 'No modifications,' but later performs a privileged command via sudo. While this specific command does not modify state, the mismatch is security-relevant because it can mislead users into approving execution under false assumptions and erodes informed consent around privilege use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The script reads the full openclaw.json configuration, which may contain tokens, passwords, or other secrets, without any user-facing notice that sensitive material will be accessed during the audit. In a skill/agent context, this increases the risk of oversharing secrets into logs, downstream tooling, crash output, or future modifications that accidentally expose the in-memory config.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The presence of sudo means the skill may attempt privileged execution from an agent-triggered script. In an automation setting, this can create password prompts, hang jobs, or encourage running the entire skill with elevated privileges, broadening the blast radius if the script is later changed or combined with less-trusted logic.

Content

Scanner excerpt · scripts/security-check.sh (reported line 198)May include surrounding context.

sh

# --- Check 8: Host Firewall ---
check8_name="Host Firewall"
if command -v ufw &>/dev/null; then
  fw_status=$(sudo ufw status 2>/dev/null | head -1 || echo "unknown")
  if echo "$fw_status" | grep -qi "active"; then
    check8_status=$(pass)
    check8_detail="UFW active"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script invokes sudo ufw status during what is presented as a fast, read-only self-check. Even though ufw status is nominally read-only, using sudo can trigger a password prompt, block automation, and normalize privileged execution for a routine audit skill, increasing the chance that users grant elevated privileges unnecessarily.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.