Security audit

Openclaw Restore

Security checks for vulnerabilities and agentic risk

Overview

This restore skill has a clear purpose, but it can replace persistent OpenClaw state and credentials from weakly validated backups and then restart OpenClaw, so users should review it carefully before installing.

Install only if you understand that restoring a backup can replace your OpenClaw memory, configuration, sessions, credentials, and skills. Use backups from a trusted source, avoid running the curl-to-bash disaster-recovery command, prefer pinned official installers, do not store backup passwords in shell environment variables, and inspect archive contents before restoring.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: README.md:151
Finding: Mutable Remote Homebrew Installer Is Downloaded and Executed Directly
Content: View full analysis
Vulnerability Details

File Location: README.md:151 and FAQ.md:207
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Technical Analysis

The disaster-recovery documentation retrieves a shell script from the mutable HEAD branch of an external repository and immediately executes the response with Bash. There is no version pinning, checksum validation, signature verification, or opportunity to inspect the downloaded payload before execution.

Although the URL is associated with Homebrew's GitHub organization, the command's effective behavior can change after this Skill has been reviewed. A compromise of the upstream repository, maintainer account, delivery infrastructure, or installation branch would turn this documented command into an arbitrary remote-code execution channel.

Installing Homebrew is ancillary to restoring OpenClaw backups and exceeds the minimum functionality required by the restoration scripts. The Skill itself only requires existing local tools such as Bash, tar, shasum, and OpenSSL.

Attack Path

An attacker compromises the upstream repository, a maintainer account, or the content-delivery path.

The attacker modifies install.sh on the mutable HEAD branch.

A user follows the Skill's macOS disaster-recovery instructions.

curl downloads the attacker's current payload.

Bash executes the response immediately without integrity or authenticity verification.

The payload performs arbitrary actions with the user's privileges and could request elevated privileges through the installation flow.

Impact Assessment

The downloaded script receives arbitrary command execution as the invoking user. It can read or modify OpenClaw configuration, API credentials, restored memories, installed Skills, shell co ...[truncated 171 chars]
Remediation: View remediation
Remediation Suggestions

Remove the curl-to-Bash command and link users to Homebrew's official installation documentation.

If automated installation is essential, pin the installer to a reviewed immutable commit rather than HEAD.

Download the installer as a separate file, verify an independently obtained cryptographic digest or signature, and only then execute it.

Display the installer source and require explicit user review before execution.

Document the minimum required local dependencies and allow users to install them through an already trusted package manager.

T02 · Agent Memory Poisoning

Error

Location: scripts/restore.sh:17
Finding: Unauthenticated Backup Archives Can Replace Persistent OpenClaw State
Content: View full analysis
Vulnerability Details

File Location: scripts/restore.sh:17-70 and scripts/restore_encrypted.sh:19-87
Vulnerability Type: Untrusted archive restoration and persistent state poisoning
Risk Level: High

Vulnerable Code

bash
if [ -f "$ARCHIVE.sha256" ]; then echo "🔐 验证备份完整性..." if ! shasum -c "$ARCHIVE.sha256"; then echo "❌ 校验失败！备份文件可能已损坏。" echo "是否仍要继续？[y/N]" read -p "> " CONFIRM if [ "$CONFIRM" != "y" ] && [ "$CONFIRM" != "Y" ]; then exit 1 fi fi echo "✓ 校验通过" fi mkdir -p "$RESTORE_TMP" echo "📦 解压备份文件..." tar -xzf "$ARCHIVE" -C "$RESTORE_TMP" if [ -d "$HOME/.openclaw" ]; then BACKUP_OLD="$HOME/.openclaw.backup.$(date +"%Y%m%d_%H%M%S")" mv "$HOME/.openclaw" "$BACKUP_OLD" fi if [ -d "$RESTORE_TMP/.openclaw" ]; then cp -a "$RESTORE_TMP/.openclaw" "$HOME/" fi if [ -d "$RESTORE_TMP/.clawdbot" ]; then cp -a "$RESTORE_TMP/.clawdbot" "$HOME/" fi if command -v openclaw >/dev/null 2>&1; then openclaw doctor || true openclaw gateway restart || true fi

The encrypted restoration path applies the same extraction and replacement behavior:

bash
if [ -f "$ENCRYPTED_ARCHIVE.sha256" ]; then if ! shasum -c "$ENCRYPTED_ARCHIVE.sha256"; then exit 1 fi fi tar -xzf "$DECRYPTED_ARCHIVE" -C "$RESTORE_TMP" if [ -d "$RESTORE_TMP/.openclaw" ]; then cp -a "$RESTORE_TMP/.openclaw" "$HOME/" fi if [ -d "$RESTORE_TMP/.clawdbot" ]; then cp -a "$RESTORE_TMP/.clawdbot" "$HOME/" fi openclaw gateway restart || true

Technical Analysis

SHA-256 sidecar verification is optional. In the unencrypted restoration script, users can proceed even after verification fails. More importantly, an ordinary checksum only detects accidental changes; it does not authenticate who created the archive because an attacker can replace both an arch ...[truncated 2015 chars]
Remediation: View remediation
Remediation Suggestions

Require cryptographic authenticity, not only integrity. Verify a digital signature from a trusted public key or an HMAC generated with a protected backup key.

Reject missing or failed authentication by default; do not permit interactive bypass for failed verification.

List and validate all archive members before extraction.

Reject absolute paths, parent-directory components, device nodes, FIFOs, hard links, and symbolic links that resolve outside the restoration root.

Restore only an explicit allowlist of expected OpenClaw files and directories.

Extract and inspect restored memory, configuration, and Skills in quarantine before replacing current state.

Do not restart the gateway automatically after restoring untrusted content. Require a separate confirmation after validation.

Preserve the rollback directory until the restored instance has been explicitly verified.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/restore_encrypted.sh:12
Finding: Predictable Shared Temporary Directories Permit Local Tampering
Content: View full analysis
Vulnerability Details

File Location: scripts/restore_encrypted.sh:12-52 and scripts/restore.sh:12-35
Vulnerability Type: Insecure temporary-file creation
Risk Level: Medium

Vulnerable Code

bash
RESTORE_TMP="/tmp/openclaw_restore_$(date +"%Y-%m-%d_%H-%M-%S")" DECRYPTED_ARCHIVE="$RESTORE_TMP/backup.tar.gz" mkdir -p "$RESTORE_TMP" if ! openssl enc -aes-256-cbc -d -pbkdf2 -iter 100000 \ -in "$ENCRYPTED_ARCHIVE" \ -out "$DECRYPTED_ARCHIVE" \ -pass pass:"$BACKUP_PASSWORD"; then rm -rf "$RESTORE_TMP" exit 1 fi tar -xzf "$DECRYPTED_ARCHIVE" -C "$RESTORE_TMP"

The plain restoration script uses the same predictable naming scheme:

bash
RESTORE_TMP="/tmp/openclaw_restore_$(date +"%Y-%m-%d_%H-%M-%S")" mkdir -p "$RESTORE_TMP" tar -xzf "$ARCHIVE" -C "$RESTORE_TMP"

Technical Analysis

The temporary directory name is derived only from the current timestamp with one-second precision. It is therefore predictable, and mkdir -p accepts a path that already exists instead of requiring exclusive creation.

On a multi-user system, a local attacker can pre-create the anticipated directory or populate it with attacker-controlled entries. In the encrypted flow, the decrypted archive is written to a predictable filename without first ensuring that it is a newly created regular file. The scripts also do not set a restrictive umask, explicitly enforce mode 0700, verify ownership, or install an EXIT trap that guarantees cleanup after signals and unexpected failures.

Attack Path

A local attacker observes or predicts when the victim starts restoration.

The attacker pre-creates the corresponding /tmp/openclaw_restore_YYYY-MM-DD_HH-MM-SS path.

The attacker places crafted files or links in that directory before mkdir -p runs.

The script accepts the existing path and writes or extracts sensitive backup data into it.

In the encrypted flow ...[truncated 642 chars]
Remediation: View remediation
Remediation Suggestions

Create an unpredictable directory atomically:

bash
umask 077 RESTORE_TMP="$(mktemp -d "${TMPDIR:-/tmp}/openclaw_restore.XXXXXX")"

Verify that the resulting path is a directory owned by the current effective user.

Install cleanup immediately after creation:

bash
cleanup() { rm -rf -- "$RESTORE_TMP" } trap cleanup EXIT HUP INT TERM

Create sensitive output files using exclusive, restrictive creation and reject symbolic links.

Keep decrypted content in a user-private location with directory mode 0700 and file mode 0600.

Do not use mkdir -p for a security-sensitive temporary workspace.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/restore_encrypted.sh:30
Finding: Backup Password Is Exposed Through Process Arguments and Environment Variables
Content: View full analysis
Vulnerability Details

File Location: scripts/restore_encrypted.sh:30-43 and README.md:205-211
Vulnerability Type: Sensitive information exposure
Risk Level: Medium

Vulnerable Code

bash
if [ -z "${OPENCLAW_BACKUP_PASSWORD:-}" ]; then echo "请输入备份密码:" read -s BACKUP_PASSWORD echo "" else BACKUP_PASSWORD="$OPENCLAW_BACKUP_PASSWORD" fi if ! openssl enc -aes-256-cbc -d -pbkdf2 -iter 100000 \ -in "$ENCRYPTED_ARCHIVE" \ -out "$DECRYPTED_ARCHIVE" \ -pass pass:"$BACKUP_PASSWORD"; then rm -rf "$RESTORE_TMP" exit 1 fi

The README also recommends a plaintext environment variable:

bash
export OPENCLAW_BACKUP_PASSWORD="your_password"

Technical Analysis

The OpenSSL -pass pass: form embeds the password directly in the process argument vector. Depending on the operating system and process-inspection controls, command-line arguments may be visible to other local users, monitoring agents, diagnostic tools, crash collectors, or process-history systems while OpenSSL is running.

The alternative environment-variable workflow also keeps the password in process environments and may encourage users to save it in shell profiles or automation files. read -s protects terminal echo but does not mitigate exposure once the value is inserted into OpenSSL's command line.

Attack Path

The victim starts restoration of a sufficiently large encrypted backup.

The script launches OpenSSL with the password embedded in its arguments.

A local process observer or monitoring system captures the OpenSSL command line or inherited environment.

The observer extracts the backup password.

The attacker obtains a copy of the encrypted backup and decrypts its OpenClaw data.

Impact Assessment

Exposure of the password compromises the confidentiality of every backup encrypted with the same password. The decrypted material may include API ...[truncated 233 chars]
Remediation: View remediation
Remediation Suggestions

Do not use -pass pass: for secrets.

Pass the password through an inherited protected file descriptor, such as OpenSSL's -pass fd:N mechanism.

Alternatively, use a mode-0600 temporary password file in a mode-0700 temporary directory and securely remove it immediately after use.

Avoid documenting a persistent plaintext password environment variable.

Recommend a system credential store or interactive secret provider for automation.

Clear the shell variable after decryption:

bash
unset BACKUP_PASSWORD OPENCLAW_BACKUP_PASSWORD

Document that backup passwords should be unique and rotated if local process exposure is suspected.

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: README.md:255
Finding: Recursive World-Readable Permissions Expose Private OpenClaw Data
Content: View full analysis
Vulnerability Details

File Location: README.md:255-256, FAQ.md:341-342, and SKILL.md:476-477
Vulnerability Type: Overly permissive filesystem permissions
Risk Level: Medium

Vulnerable Code

bash
chmod -R 755 ~/.openclaw chmod 600 ~/.openclaw/config.yaml

Technical Analysis

Recursive mode 755 gives every local user read and traversal access to all files and directories under ~/.openclaw. Only config.yaml is subsequently returned to mode 600. Other files can include memories, logs, workspace content, channel sessions, cached credentials, private Skill data, and API-related material.

Files generally do not need execute permission, and private application data does not need to be readable by other users. The command therefore exceeds least privilege and can expose restored secrets while attempting to solve an unrelated permissions problem.

Attack Path

A user encounters a restoration-related permission error.

The user follows the documented troubleshooting command.

Every file below ~/.openclaw becomes readable by other local accounts.

Another local user or service enumerates the directory and reads sensitive files not covered by the subsequent chmod 600 command.

Extracted tokens or private data are used for account access or information disclosure.

Impact Assessment

Any local account with filesystem access can potentially read sensitive OpenClaw data. The exposed scope may include Agent memories, conversation data, logs, bot tokens, channel state, API credentials stored outside config.yaml, and private Skill configuration. The command does not itself grant write access to other users, but disclosure of credentials may enable access to external systems.
Remediation: View remediation
Remediation Suggestions

Remove the recursive chmod 755 recommendation.

Set private directories to mode 700 and sensitive regular files to mode 600.

Grant execute permission only to files that are genuinely executable.

Use type-specific commands where repair is required:

bash
find "$HOME/.openclaw" -type d -exec chmod 700 {} + find "$HOME/.openclaw" -type f -exec chmod 600 {} +

Restore executable permission only on reviewed scripts that require it.

Verify ownership before changing permissions and avoid running recursive permission changes with elevated privileges.

Document platform-specific OpenClaw permission requirements instead of applying broad generic modes.

T08 · Insecure Dependencies

Warning

Location: README.md:157
Finding: Unpinned Global OpenClaw Package Installation Creates Supply-Chain Exposure
Content: View full analysis
Vulnerability Details

File Location: README.md:157, FAQ.md:213,298, and SKILL.md:407
Vulnerability Type: Unpinned global dependency installation
Risk Level: Medium

Vulnerable Code

bash
npm install -g openclaw

Technical Analysis

The disaster-recovery instructions install the latest package currently associated with the openclaw registry name. No package version, integrity hash, lockfile, signature, or trusted release artifact is specified. NPM installation may execute package lifecycle scripts, making installation an immediate code-execution boundary.

Global installation also modifies user-wide or system-wide tooling rather than using a project-contained dependency. The command is relevant to rebuilding an OpenClaw installation, but its unpinned form exposes the recovery process to unexpected upstream releases, registry account compromise, and package supply-chain incidents.

Attack Path

An attacker compromises the package publisher account, registry entry, or a transitive dependency used by the latest release.

A malicious package version or lifecycle script is published.

A user follows the disaster-recovery documentation.

NPM resolves the unpinned name to the malicious current version.

Installation or lifecycle scripts execute with the privileges used for global installation.

The malicious package modifies OpenClaw state, user files, or globally installed tooling.

Impact Assessment

A compromised package can execute arbitrary code as the account performing installation. If the package manager is run with administrative privileges due to global-installation permissions, the effect may extend to system-wide files and tools. Otherwise, the likely scope includes user files, restored OpenClaw credentials and memories, shell configuration, and user-global NPM packages.
Remediation: View remediation
Remediation Suggestions

Pin OpenClaw to a reviewed, known-good version:

bash
npm install -g openclaw@REVIEWED_VERSION

Verify the package's registry provenance, integrity metadata, and official publisher before installation.

Prefer an official signed release or a package-manager lockfile that records exact dependency versions and integrity values.

Avoid administrative execution and configure a user-owned NPM prefix if global installation is required.

Consider disabling lifecycle scripts during initial retrieval and explicitly reviewing any required scripts before running them.

Document a tested OpenClaw version compatible with the backup format rather than automatically selecting the newest release.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (32)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · CLAWHUB.md (reported line 15)May include surrounding context.
md
# OpenClaw Restore Skill 🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份** [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 3)May include surrounding context.
md
# OpenClaw Restore Skill 🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份** [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 89)May include surrounding context.
md
# OpenClaw Restore Skill 🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份** [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
# OpenClaw Restore Skill 🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份** [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
md
# OpenClaw Restore Skill 🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份** [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.
md
# OpenClaw Restore Skill 🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份** [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.
md
# OpenClaw Restore Skill 🐈‍⬛ **一键恢复 OpenClaw 数据，支持加密和未加密备份** [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![OpenClaw](https://img.shields.io/badge/OpenClaw-Skill-blue)](https://openclaw.ai)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 272)May include surrounding context.
确认恢复成功后可删除：

bash
rm -rf ~/.openclaw.backup.20260313_204600

完整性验证

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 272)May include surrounding context.
确认恢复成功后可删除：

bash
rm -rf ~/.openclaw.backup.20260313_204600

完整性验证

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.
md
--- name: openclaw-restore slug: halaoluan-openclaw-restore version: 1.0.0 description: 一键恢复 OpenClaw 数据（支持加密/未加密备份）。Use when user asks to restore OpenClaw, recover data, restore from backup, or fix broken installation. Triggers: "恢复", "restore", "recover", "恢复备份", "还原数据", "restore backup". --- # OpenClaw 恢复 Skill 从备份文件一键恢复 OpenClaw 数据，支持加密和未加密备份。 --- ## 使用场景 | 触发词 | 操作 | |--------|------| | "恢复 OpenClaw" | 从备份恢复数据 | | "恢复最新备份" | 自动选择最新备份恢复 | | "恢复加密备份" | 解密并恢复 | | "列

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
位置：`scripts/restore.sh`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.
md
位置：`scripts/restore.sh`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
echo "" if [ -n "${BACKUP_OLD:-}" ]; then echo "旧数据已备份到: $BACKUP_OLD" echo "确认恢复成功后可删除: rm -rf $BACKUP_OLD" fi

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
echo "" if [ -n "${BACKUP_OLD:-}" ]; then echo "旧数据已备份到: $BACKUP_OLD" echo "确认恢复成功后可删除: rm -rf $BACKUP_OLD" fi

text

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
md
位置：`scripts/restore_encrypted.sh`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.
md
位置：`scripts/restore_encrypted.sh`

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file’s user-facing instructions and descriptions are presented only in Chinese, and there is no indication that the skill is intended exclusively for a Chinese-speaking audience or that alternate language support is available. This can violate language/locale policy when users are not given an opt-in or choice of language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This markdown file uses Chinese throughout, including headings, instructions, and troubleshooting steps, and does not provide any indication that the skill is region-specific or that users may choose another language. Under the language/locale policy, forcing a single language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · FAQ.md (reported line 395)May include surrounding context.
诊断：

bash
ls -la ~/.openclaw/skills/ openclaw skills list

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · FAQ.md (reported line 418)May include surrounding context.
诊断：

bash
ls -la ~/.openclaw/skills/ openclaw skills list

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill description begins in Chinese and the rest of the README continues entirely in Chinese, with no indication that other languages are supported or that the locale is intentionally constrained. Under the policy for natural-language violations, this is a language-choice issue because users are not given an opt-in or alternative.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · FAQ.md (reported line 342)May include surrounding context.
解决：

bash
chmod -R 755 ~/.openclaw chmod 600 ~/.openclaw/config.yaml

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 256)May include surrounding context.
解决：

bash
chmod -R 755 ~/.openclaw chmod 600 ~/.openclaw/config.yaml

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 477)May include surrounding context.
解决：

bash
chmod -R 755 ~/.openclaw chmod 600 ~/.openclaw/config.yaml

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Chinese activation phrases are similarly broad and can match routine troubleshooting or recovery discussions rather than a deliberate request to execute a restore operation. Because the skill performs destructive actions, ambiguous invocation language materially raises the risk of accidental execution.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T02 · Agent Memory Poisoning

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Tool Parameter Abuse

完整性验证

Tool Parameter Abuse

完整性验证

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

Ae1

Ae1

Tool Parameter Abuse

Tool Parameter Abuse

Ae1

Ae1

Natural-Language Policy Violations

Natural-Language Policy Violations

File System Enumeration

File System Enumeration

Natural-Language Policy Violations

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Vague Triggers