ClawHub
Back to skill

Security audit

OpenClaw Starter Kit

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent Korean OpenClaw onboarding skill, but it includes unsafe root-level install guidance and under-scoped persistent automation setup that users should review before installing.

Review this skill before installing if you are not intentionally setting up a Korean-language OpenClaw environment. Do not run the `sudo npm install -g openclaw` troubleshooting command as written; prefer a user-scoped install method and verify package provenance. Treat recommended skills, `--force` reinstalls, cron jobs, and HEARTBEAT.md tasks as optional and approve only the exact tools, schedules, and permissions you want.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:69
Finding

Unpinned Third-Party Skill Installation Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:69-78; guides/skill-recommendations.md:3-26
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet

From SKILL.md:74-78:

bash
openclaw configure --section web
openclaw skills install weather
openclaw skills install summarize
openclaw skills install github
openclaw skills install youtube-transcript

Additional recommendations from guides/skill-recommendations.md:15-26:

bash
openclaw skills install github
openclaw skills install youtube-transcript
openclaw skills install gog
openclaw skills install notion
openclaw skills install coding-agent
openclaw skills install supabase
openclaw skills install nano-pdf

Technical Analysis

The project recommends installing third-party Skills by mutable package name without specifying a reviewed version, immutable digest, trusted publisher, authoritative source repository, checksum, or signature. The resolved content can therefore change after this project has been audited.

This creates a supply-chain trust boundary: the safety of the onboarding process depends on the continued integrity of the external Skill registry, each publisher account, and every future release associated with the recommended names. A registry compromise, publisher-account takeover, namespace reassignment, or malicious package update could cause a legitimate-looking command to install attacker-controlled content.

The higher-capability recommendations, such as coding, database, GitHub, email, calendar, and document-processing Skills, may receive access to sensitive local files, service credentials, network APIs, or execution tools depending on the OpenClaw permission model.

Attack Path

  1. An attacker compromises a recommended Skill publisher account, compromises registry resolution, takes over an abandoned namespace, or publishes a malicious future release.
  2. The package remains available under the same name docu ...[truncated 1118 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin each recommended Skill to a reviewed, immutable version or content digest.
  2. Document the authoritative publisher and source repository for every recommendation.
  3. Require signature or checksum verification where the registry supports it.
  4. Review the complete Skill package, including scripts and lifecycle behavior, before recommending it.
  5. Document the minimum permissions needed by each Skill and require explicit user approval before granting access.
  6. Avoid automatically installing recommendations; present them as optional components with a supply-chain warning.
  7. Establish an allowlist of approved package names, publishers, versions, and hashes.
  8. Periodically re-audit pinned versions and provide a controlled update process rather than resolving the latest release automatically.

T08 · Insecure Dependencies

Error
Location
guides/troubleshooting.md:26
Finding

Privileged Unpinned npm Installation Can Execute Package Code as Root

Content
View full analysis

Vulnerability Details

File Location: guides/troubleshooting.md:26-32
Vulnerability Type: Privileged installation of an unpinned external package and forced Skill replacement
Risk Level: High

Vulnerable Code Snippet

bash
sudo npm install -g openclaw

openclaw skills install [Skill name] --force

Technical Analysis

The troubleshooting guide recommends installing the mutable openclaw npm package globally through sudo. npm packages can define lifecycle scripts, including installation hooks, which may execute during installation. Running npm under sudo grants those scripts root privileges.

The command does not pin a reviewed version, verify an integrity digest, validate a signature, confirm the package publisher, or disable lifecycle scripts. Consequently, the effective code executed by the command is controlled by the package version resolved from the npm registry at installation time.

The subsequent --force recommendation can replace an existing Skill without establishing that the replacement artifact is trusted. Although forced replacement does not inherently create privilege escalation, it weakens safeguards against overwriting known-good Skill content.

Attack Path

  1. An attacker compromises the npm package publisher, the registry account, package resolution, or another part of the package-distribution chain.
  2. The attacker publishes or serves a malicious release under the expected package name.
  3. A user encounters an installation or permission problem and follows the troubleshooting instructions.
  4. The user executes sudo npm install -g openclaw.
  5. npm downloads the mutable package release and runs any applicable lifecycle scripts with root privileges.
  6. The malicious script modifies system-wide files, installs persistent components, replaces executables, steals readable secrets, or otherwise compromises the host.
  7. Separately, if the user follows the --force instruction for a Skill, an attacker-contro ...[truncated 857 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the recommendation to run npm through sudo.
  2. Use a user-scoped Node.js version manager or another official, non-root installation mechanism.
  3. Pin openclaw to a reviewed version and verify its expected integrity digest and publisher provenance.
  4. Use npm lockfiles or equivalent immutable dependency controls where applicable.
  5. Disable npm lifecycle scripts with --ignore-scripts unless they are explicitly required and have been audited.
  6. If lifecycle scripts are necessary, inspect the exact package archive and scripts before installation.
  7. Replace the generic --force instruction with an explicit workflow that removes the old Skill, verifies the exact replacement version and publisher, reviews requested permissions, and then installs it.
  8. Run OpenClaw and installed Skills under a dedicated, least-privileged operating-system account.
  9. Document recovery procedures for package compromise, including uninstalling the affected release, rotating exposed credentials, checking system persistence, and restoring trusted binaries.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (20)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · guides/security-guide.md (reported line 23)May include surrounding context.

.gitignore 설정

text
.env
*.env
secrets/

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · guides/security-guide.md (reported line 24)May include surrounding context.

.gitignore 설정

text
.env
*.env
secrets/

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description advertises activation on very generic phrases such as 'starter kit', '온보딩', 'setup guide', and '시작하기', which can appear in normal conversation unrelated to this skill. Because the skill performs multi-step onboarding and file generation, accidental activation could trigger collection of personal preferences or cause unintended configuration guidance in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger list includes ambiguous phrases like '초기 세팅', '보안 설정', and '세팅 도와줘' that are common support-language and could match many benign user requests. In this skill, activation leads into operational setup, recommended package installation, and environment-specific guidance, so broad matching increases the chance of misrouting user intent and initiating sensitive setup flows unintentionally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire roadmap is written in Korean and does not indicate that language selection is optional or configurable. Under the policy criteria, a skill document that implicitly requires a specific language without user opt-in can constitute a locale/language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guide instructs users to configure cron behavior through broad natural-language phrases without defining strict trigger boundaries, confirmation requirements, or parsing constraints. In an agent skill, this can cause unintended scheduled actions if similar conversational input is misinterpreted as a command, especially during onboarding where users are experimenting with setup language.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The management commands rely on ambiguous references like 'that cron job,' which can lead the agent to disable or delete the wrong scheduled task if multiple jobs exist or conversational context is unclear. Because these actions modify persistent automation state, ambiguity creates a real risk of accidental disruption or loss of important reminders and reports.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown guide forces a specific language for all users, and there is no indication that the skill documentation is intentionally limited to Korean-speaking users or that an alternative language is available. Under the policy, language-specific guidance without user opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
91% confidence
Finding

The troubleshooting guide instructs users to run 'sudo npm install -g openclaw', which executes package installation scripts with root privileges. If the package, a dependency, or the registry path is compromised, this can lead to full system compromise, and the onboarding/troubleshooting context makes users more likely to copy-paste the command without scrutiny.

Content

Scanner excerpt · guides/troubleshooting.md (reported line 29)May include surrounding context.

🔴 스킬 설치가 안 돼요

bash
# 권한 문제
sudo npm install -g openclaw

# 스킬 재설치
openclaw skills install [스킬명] --force

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description states the skill is 'for beginners' and describes the onboarding in Korean, while the keywords also emphasize Korean/한국어. This suggests a language-specific experience without any indication that users can choose another language, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The entire template is written as a Korean-language AGENTS.md template, including headings and behavioral instructions, with no indication that language choice is optional or user-configurable. This creates a natural-language policy concern because it implicitly fixes the skill's operating language/locale without user opt-in or a documented region-specific reason.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The heartbeat description says the agent will read this file periodically and execute tasks if present, but it does not define strict scope, allowed actions, approval requirements, or exclusion conditions. In an agent setting, a broadly scoped periodic trigger can enable unintended autonomous actions if someone later uncommented or added sensitive checks such as email, calendar, or project access without guardrails.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

Defaulting the user's timezone to 'Asia/Seoul' without explicit opt-in can cause misconfiguration of scheduled actions, reminders, and heartbeat behavior for users in other regions. In an onboarding skill that later discusses cron jobs and automated check-ins, an incorrect locale can have downstream operational and privacy effects, though the risk is limited compared to direct code execution or secret exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains user-facing guidance only in Korean, which effectively forces a specific language for readers. Under the policy rule, a skill should not impose a language or locale without user opt-in or a clearly documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains only Korean-language instructions and headings, which can amount to a forced language choice for users if the skill documentation is expected to be generally usable. The policy allows locale constraints when they are explicitly documented and justified, but no such justification or opt-in appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

All instructional text in the template is presented in Korean, and there is no indication that this language choice is optional or intentionally limited to a Korean-speaking environment. This can violate language or locale policy where skills should not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown template includes persona instructions that force a specific language/locale style, such as honorific Korean. The policy category applies to natural-language constraints, and the file does not state that the user can choose or opt into these language settings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The example hard-codes '반말' and a casual conversational style, which is a language/register constraint. Because the template does not frame this as optional or user-selected, it can conflict with organizational language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The phrase '한국어/영어 혼용 OK' establishes a locale/language behavior in the template itself. Under the policy rule, language constraints should be user-selectable or clearly justified; neither is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template hard-codes Timezone: Asia/Seoul, which can cause users to unknowingly adopt an incorrect locale setting and disclose or inherit regional information they did not choose. In an onboarding skill, defaults in a user profile template are likely to be copied directly, so this can lead to misconfiguration and minor privacy or usability issues.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.