ClawHub
Back to skill

Security audit

Agent Migrate

Security checks for vulnerabilities and agentic risk

Overview

This migration skill matches its stated purpose, but its scripts can upload sensitive agent state and run unverified restore code, so it needs careful review before use.

Review before installing or using. Only use this with repositories and archives you fully control, inspect restore.sh before running pull or restore workflows, remove or disable the force-push fallback, sanitize or encrypt OpenClaw configuration and memory before transfer, and avoid exposing the gateway publicly without strong authentication, pinned images, and restricted volumes.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/sync-github.sh:160
Finding

Arbitrary Remote Script Execution During Repository Restore

Content
View full analysis
--pull ``` 4. The script clones the repository. 5. It changes into the downloaded `agent-backup` directory. 6. It executes the attacker-controlled `restore.sh` without verification. 7. The payload runs with all privileges available to the user executing the Skill. ### Impact Assessment The attacker obtains arbitrary command execution under the Skill process account. The payload can read or modify all files accessible to that account, steal OpenClaw credentials and Agent state, alter the workspace, install persistence where permissions permit, or invoke network-accessible resources. If the script is run as root, including in t ...[truncated 217 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/sync-github.sh:47
Finding

Sensitive Agent Data Can Be Uploaded Through Ineffective Secret Redaction

Content
View full analysis
/dev/null || true fi done # 2. memory 目录 if [ -d "/home/node/.openclaw/workspace/memory" ]; then echo " - 记忆文件" cp -r "/home/node/.openclaw/workspace/memory" agent-backup/ 2>/dev/null || true fi # 3. 已安装 skills 清单（只存名字，不存内容） echo " - skills 清单" ls /usr/local/lib/node_modules/openclaw/skills/ > agent-backup/installed-skills.txt 2>/dev/null || true # 4. 自定义 skills（如果有） if [ -d "/home/node/.openclaw/skills" ]; then echo " - 自定义 skills" mkdir -p agent-backup/custom-skills cp /home/node/.openclaw/skills/*.skill agent-backup/custom-skills/ 2>/dev/null || true fi # 5. 配置模板（脱敏） echo " - 配置模板（脱敏）" if [ -f "/home/node/.openclaw/openclaw.json" ]; then jq 'walk(if type == "object" then with_entries(if .value | type == "string" and (contains("key") or contains("token") or contains("secret")) then .value = "***REMOVED***" else . end) else . end)' "/home/node/.openclaw/openclaw.json" > agent-backup/openclaw.json.template 2>/dev/null || \ echo "{}" > agent-backup/openclaw.json.template fi ``` The collected content is subsequently committed and pushed: ```bash git add -A git commit -m "Agent backup: $(date '+%Y-%m-%d %H:%M:%S')" || true echo " → 推送到远程..." git push origin HEAD:main 2>/dev/null || git push origin HEAD:master 2>/dev/null || { echo " 尝试强制推送..." git push --force origin HEAD:main 2>/dev/null || git push --force origin HEAD:master 2>/dev/null } ``` ### Technical Analysis The `jq` expression checks whether ...[truncated 2088 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/export-agent.sh:22
Finding

Raw OpenClaw Configuration Is Included in Transferable Export Archives

Content
View full analysis
/dev/null || true ``` The raw configuration is then included in the final archive: ```bash # 8. 打包最终导出 cd /tmp FINAL_ARCHIVE="agent-export-$EXPORT_NAME.tar.gz" tar czf "$FINAL_ARCHIVE" "agent-export-$EXPORT_NAME" ``` ### Technical Analysis The export script copies `openclaw.json` verbatim and packages it into a transferable archive under `/tmp`. OpenClaw configuration can contain gateway credentials, model API keys, endpoint credentials, and other sensitive values. Although `SKILL.md` advises users to sanitize the configuration, the executable workflow performs no sanitization and does not request confirmation before including it. The script also does not explicitly enforce restrictive permissions on the export directory or final archive; effective access therefore depends on the environment's umask and `/tmp` protections. ### Attack Path 1. `openclaw.json` contains active credentials or sensitive endpoints. 2. A user invokes `scripts/export-agent.sh`. 3. The script copies the complete configuration into the export directory. 4. The directory, including the plaintext configuration, is packaged into `/tmp/agent-export-.tar.gz`. 5. The archive is transferred, uploaded, retained, or accidentally published as instructed by the migration workflow. 6. Anyone who obtains the archive extracts `config/openclaw.json` and recovers the credentials. ### Impact Assessment An archive recipient may obtain every credential stored in `openclaw.json`. The resulting privileges depend on those credentials and can include access to model-provider accounts, the OpenClaw gateway, connected integrations, or other configured services. The exposur ...[truncated 142 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
scripts/sync-github.sh:93
Finding

Unverified Remote Backups Can Poison Persistent Agent Instructions and Memory

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/docker-deploy.md:6
Finding

Docker Deployment Uses Mutable and Unpinned Dependencies

Content
View full analysis
Remediation
View remediation
`. - Pin OpenClaw to an exact reviewed version rather than installing the latest release. - Verify npm package integrity and provenance. - Use a lockfile or equivalent reproducible dependency mechanism where applicable. - Scan the resulting image and software bill of materials during CI. - Rebuild only after reviewing dependency updates. - Run the final container as a non-root user with a read-only root filesystem where possible. - Limit mounted volumes and avoid exposing credentials not required at runtime. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The push logic will attempt normal pushes and then automatically fall back to force-pushing to whatever repository URL the user supplied. This can overwrite remote history destructively and, because the remote is arbitrary, can be abused to alter or replace contents in a repository without any confirmation or branch protection checks.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script may perform destructive force-pushes after normal push failures, yet it provides no explicit warning that remote history may be overwritten. This omission materially increases the chance of accidental data loss or misuse, especially when used against shared repositories or when the remote URL is mistyped.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Use of git push --force against a user-supplied remote is a classic dangerous parameter pattern because it can rewrite or erase repository history. In this script, that capability is automatically invoked as a fallback, which amplifies the risk of destructive misuse or accidental corruption of backup repositories.

Content

Scanner excerpt · scripts/sync-github.sh (reported line 153)May include surrounding context.

sh
echo "  → 推送到远程..."
    git push origin HEAD:main 2>/dev/null || git push origin HEAD:master 2>/dev/null || {
        echo "  尝试强制推送..."
        git push --force origin HEAD:main 2>/dev/null || git push --force origin HEAD:master 2>/dev/null
    }
    
    echo "[SYNC] ✅ 推送完成"

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

In pull mode, the script clones a remote repository and immediately executes ./restore.sh from that repository without validating its contents, origin, or integrity. That is effectively arbitrary code execution from a remote source, and in an agent-migration context it is particularly dangerous because the restore process may run with access to the agent's files, credentials, and workspace.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill clearly instructs users to run shell commands and scripts (scp, ./restore.sh, ./scripts/*) but does not declare any permissions or allowed-tools scope in its metadata. That mismatch weakens guardrails by making the skill's command-execution capability implicit rather than explicit, which can lead to overbroad tool access, poor reviewability, and accidental execution of destructive migration commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill recommends syncing full agent state to GitHub for deployment, and the documented agent state includes memory, identity files, configs, extensions, and possibly session data. Without a prominent warning that this transfers potentially sensitive agent data off-host to a third-party service, users may exfiltrate secrets, private memory, operational rules, or tokens into remote repositories, where exposure can be persistent and broad.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide instructs users to expose the agent gateway on a host port and mount persistent agent/workspace data, but it does not warn that this can expose a remotely reachable control surface and sensitive local data. In the context of an agent migration/deployment skill, this is more dangerous because the mounted workspace and persisted state likely contain credentials, prompts, history, and operational artifacts that could be accessed or modified if the gateway is misconfigured or broadly reachable.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

In full mode, the script archives the entire agents directory as session data without any warning, consent prompt, or redaction step. In an agent migration skill, sessions can contain prompts, secrets, tokens, or operational history, so silently bundling them into a transferable /tmp archive increases the risk of unintended disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The generated restore script extracts archives and copies configuration directly into the target directory without preview, backup, or confirmation. In a migration/deployment context this can overwrite existing agent state or configuration unexpectedly, causing loss of data, rollback of secure settings, or accidental deployment of stale or unsafe files.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The script is designed to export agent state from the local machine into an arbitrary GitHub repository, which is an external publication/synchronization action rather than a narrowly scoped local migration helper. Even if the repository is intended to be private, this materially increases the risk of accidental disclosure of agent identity, memory, custom skills, and host metadata to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script's comments and user-visible echo output are written in Chinese, including usage/help and operational status messages. This imposes a specific language on users without offering a locale choice or documenting that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script copies core identity files, memory contents, skill metadata, custom skills, and host/user details into a git repository and then pushes them remotely, but it does not present any explicit privacy or sensitivity warning to the operator. In this skill context, agent workspace and memory are especially likely to contain secrets, internal prompts, operational history, or sensitive business data, so silent export is risky.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

A skill document that forces a single language can violate language/locale policy when it does not offer user choice or state a justified region-specific scope. This file presents all instructions in Chinese only, with no opt-in or alternative language guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file includes Chinese-language comments and user-visible status messages, and the runtime output shown throughout the script is presented in Chinese only. This can violate language or locale policy when no user opt-in or documented locale constraint is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.