OpenClaw Starter Kit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:59 PM UTC
• Version: 1.0.1

Overview

This is a mostly coherent Korean OpenClaw onboarding skill, but it includes unsafe root-level install guidance and under-scoped persistent automation setup that users should review before installing.

Review this skill before installing if you are not intentionally setting up a Korean-language OpenClaw environment. Do not run the `sudo npm install -g openclaw` troubleshooting command as written; prefer a user-scoped install method and verify package provenance. Treat recommended skills, `--force` reinstalls, cron jobs, and HEARTBEAT.md tasks as optional and approve only the exact tools, schedules, and permissions you want.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:69
• Finding: Unpinned Third-Party Skill Installation Creates Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:69-78`; `guides/skill-recommendations.md:3-26` **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code Snippet From `SKILL.md:74-78`: ```bash openclaw configure --section web openclaw skills install weather openclaw skills install summarize openclaw skills install github openclaw skills install youtube-transcript ``` Additional recommendations from `guides/skill-recommendations.md:15-26`: ```bash openclaw skills install github openclaw skills install youtube-transcript openclaw skills install gog openclaw skills install notion openclaw skills install coding-agent openclaw skills install supabase openclaw skills install nano-pdf ``` ### Technical Analysis The project recommends installing third-party Skills by mutable package name without specifying a reviewed version, immutable digest, trusted publisher, authoritative source repository, checksum, or signature. The resolved content can therefore change after this project has been audited. This creates a supply-chain trust boundary: the safety of the onboarding process depends on the continued integrity of the external Skill registry, each publisher account, and every future release associated with the recommended names. A registry compromise, publisher-account takeover, namespace reassignment, or malicious package update could cause a legitimate-looking command to install attacker-controlled content. The higher-capability recommendations, such as coding, database, GitHub, email, calendar, and document-processing Skills, may receive access to sensitive local files, service credentials, network APIs, or execution tools depending on the OpenClaw permission model. ### Attack Path 1. An attacker compromises a recommended Skill publisher account, compromises registry resolution, takes over an abandoned namespace, or publishes a malicious future release. 2. The package remains available under the same name docu ...[truncated 1118 chars]
• Remediation: ## Remediation Suggestions 1. Pin each recommended Skill to a reviewed, immutable version or content digest. 2. Document the authoritative publisher and source repository for every recommendation. 3. Require signature or checksum verification where the registry supports it. 4. Review the complete Skill package, including scripts and lifecycle behavior, before recommending it. 5. Document the minimum permissions needed by each Skill and require explicit user approval before granting access. 6. Avoid automatically installing recommendations; present them as optional components with a supply-chain warning. 7. Establish an allowlist of approved package names, publishers, versions, and hashes. 8. Periodically re-audit pinned versions and provide a controlled update process rather than resolving the latest release automatically.

T08 · Insecure Dependencies

Error

• Location: guides/troubleshooting.md:26
• Finding: Privileged Unpinned npm Installation Can Execute Package Code as Root## Vulnerability Details **File Location**: `guides/troubleshooting.md:26-32` **Vulnerability Type**: Privileged installation of an unpinned external package and forced Skill replacement **Risk Level**: High ### Vulnerable Code Snippet ```bash sudo npm install -g openclaw openclaw skills install [Skill name] --force ``` ### Technical Analysis The troubleshooting guide recommends installing the mutable `openclaw` npm package globally through `sudo`. npm packages can define lifecycle scripts, including installation hooks, which may execute during installation. Running npm under `sudo` grants those scripts root privileges. The command does not pin a reviewed version, verify an integrity digest, validate a signature, confirm the package publisher, or disable lifecycle scripts. Consequently, the effective code executed by the command is controlled by the package version resolved from the npm registry at installation time. The subsequent `--force` recommendation can replace an existing Skill without establishing that the replacement artifact is trusted. Although forced replacement does not inherently create privilege escalation, it weakens safeguards against overwriting known-good Skill content. ### Attack Path 1. An attacker compromises the npm package publisher, the registry account, package resolution, or another part of the package-distribution chain. 2. The attacker publishes or serves a malicious release under the expected package name. 3. A user encounters an installation or permission problem and follows the troubleshooting instructions. 4. The user executes `sudo npm install -g openclaw`. 5. npm downloads the mutable package release and runs any applicable lifecycle scripts with root privileges. 6. The malicious script modifies system-wide files, installs persistent components, replaces executables, steals readable secrets, or otherwise compromises the host. 7. Separately, if the user follows the `--force` instruction for a Skill, an attacker-contro ...[truncated 857 chars]
• Remediation: ## Remediation Suggestions 1. Remove the recommendation to run npm through `sudo`. 2. Use a user-scoped Node.js version manager or another official, non-root installation mechanism. 3. Pin `openclaw` to a reviewed version and verify its expected integrity digest and publisher provenance. 4. Use npm lockfiles or equivalent immutable dependency controls where applicable. 5. Disable npm lifecycle scripts with `--ignore-scripts` unless they are explicitly required and have been audited. 6. If lifecycle scripts are necessary, inspect the exact package archive and scripts before installation. 7. Replace the generic `--force` instruction with an explicit workflow that removes the old Skill, verifies the exact replacement version and publisher, reviews requested permissions, and then installs it. 8. Run OpenClaw and installed Skills under a dedicated, least-privileged operating-system account. 9. Document recovery procedures for package compromise, including uninstalling the affected release, rotating exposed credentials, checking system persistence, and restoring trusted binaries.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (20)

Credential Access

High

• Category: Privilege Escalation

Content

### .gitignore 설정
```
.env
*.env
secrets/
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### .gitignore 설정
```
.env
*.env
secrets/
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The description advertises activation on very generic phrases such as 'starter kit', '온보딩', 'setup guide', and '시작하기', which can appear in normal conversation unrelated to this skill. Because the skill performs multi-step onboarding and file generation, accidental activation could trigger collection of personal preferences or cause unintended configuration guidance in the wrong context.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list includes ambiguous phrases like '초기 세팅', '보안 설정', and '세팅 도와줘' that are common support-language and could match many benign user requests. In this skill, activation leads into operational setup, recommended package installation, and environment-specific guidance, so broad matching increases the chance of misrouting user intent and initiating sensitive setup flows unintentionally.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The entire roadmap is written in Korean and does not indicate that language selection is optional or configurable. Under the policy criteria, a skill document that implicitly requires a specific language without user opt-in can constitute a locale/language policy violation.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The guide instructs users to configure cron behavior through broad natural-language phrases without defining strict trigger boundaries, confirmation requirements, or parsing constraints. In an agent skill, this can cause unintended scheduled actions if similar conversational input is misinterpreted as a command, especially during onboarding where users are experimenting with setup language.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The management commands rely on ambiguous references like 'that cron job,' which can lead the agent to disable or delete the wrong scheduled task if multiple jobs exist or conversational context is unclear. Because these actions modify persistent automation state, ambiguity creates a real risk of accidental disruption or loss of important reminders and reports.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown guide forces a specific language for all users, and there is no indication that the skill documentation is intentionally limited to Korean-speaking users or that an alternative language is available. Under the policy, language-specific guidance without user opt-in or documented justification is a natural-language policy violation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 🔴 스킬 설치가 안 돼요
```bash
# 권한 문제
sudo npm install -g openclaw

# 스킬 재설치
openclaw skills install [스킬명] --force

• Confidence: 91% confidence
• Finding: The troubleshooting guide instructs users to run 'sudo npm install -g openclaw', which executes package installation scripts with root privileges. If the package, a dependency, or the registry path is compromised, this can lead to full system compromise, and the onboarding/troubleshooting context makes users more likely to copy-paste the command without scrutiny.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The description states the skill is 'for beginners' and describes the onboarding in Korean, while the keywords also emphasize Korean/한국어. This suggests a language-specific experience without any indication that users can choose another language, which is a natural-language locale policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The entire template is written as a Korean-language AGENTS.md template, including headings and behavioral instructions, with no indication that language choice is optional or user-configurable. This creates a natural-language policy concern because it implicitly fixes the skill's operating language/locale without user opt-in or a documented region-specific reason.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The heartbeat description says the agent will read this file periodically and execute tasks if present, but it does not define strict scope, allowed actions, approval requirements, or exclusion conditions. In an agent setting, a broadly scoped periodic trigger can enable unintended autonomous actions if someone later uncommented or added sensitive checks such as email, calendar, or project access without guardrails.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: Defaulting the user's timezone to 'Asia/Seoul' without explicit opt-in can cause misconfiguration of scheduled actions, reminders, and heartbeat behavior for users in other regions. In an onboarding skill that later discusses cron jobs and automated check-ins, an incorrect locale can have downstream operational and privacy effects, though the risk is limited compared to direct code execution or secret exposure.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This markdown file contains user-facing guidance only in Korean, which effectively forces a specific language for readers. Under the policy rule, a skill should not impose a language or locale without user opt-in or a clearly documented regional justification.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This markdown file contains only Korean-language instructions and headings, which can amount to a forced language choice for users if the skill documentation is expected to be generally usable. The policy allows locale constraints when they are explicitly documented and justified, but no such justification or opt-in appears here.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: All instructional text in the template is presented in Korean, and there is no indication that this language choice is optional or intentionally limited to a Korean-speaking environment. This can violate language or locale policy where skills should not force a specific language without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: This markdown template includes persona instructions that force a specific language/locale style, such as honorific Korean. The policy category applies to natural-language constraints, and the file does not state that the user can choose or opt into these language settings.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The example hard-codes '반말' and a casual conversational style, which is a language/register constraint. Because the template does not frame this as optional or user-selected, it can conflict with organizational language/locale policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The phrase '한국어/영어 혼용 OK' establishes a locale/language behavior in the template itself. Under the policy rule, language constraints should be user-selectable or clearly justified; neither is provided here.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The template hard-codes `Timezone: Asia/Seoul`, which can cause users to unknowingly adopt an incorrect locale setting and disclose or inherit regional information they did not choose. In an onboarding skill, defaults in a user profile template are likely to be copied directly, so this can lead to misconfiguration and minor privacy or usability issues.

Static analysis

No suspicious patterns detected.