Security audit

Coding Team Setup

Security checks for vulnerabilities and agentic risk

Overview

This is a real OpenClaw team setup wizard, but it includes under-scoped persistent telemetry/cron instructions and unsafe setup code that can overwrite or remove unintended OpenClaw files or agent configuration.

Review before installing. Use this only in an OpenClaw environment where you are comfortable letting the wizard modify global agent configuration and create persistent agent files. Avoid untrusted team names or custom role IDs, keep backups, inspect diffs before restarting the gateway, and do not enable the weekly telemetry/optimization cron unless you add explicit opt-in, redaction, retention, and review controls.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

Location: SKILL.md:197
Finding: Mandatory Cross-Session Cron Task Performs Autonomous Global Configuration and Memory Writes
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: wizard/setup.js:190
Finding: Path Traversal Through Unvalidated Team Names and Custom Role IDs
Content: View full analysis
s.trim()) : [] }; ``` The untrusted values are then used to construct filesystem paths: ```javascript for (const [roleId, role] of Object.entries(selectedRoles)) { const agentId = `${teamPrefix}${roleId}`; const wsPath = path.join(openclawPath, 'agents', agentId, 'workspace'); if (!fs.existsSync(wsPath)) { fs.mkdirSync(wsPath, { ...[truncated 3233 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: wizard/setup.js:441
Finding: Regex Injection and Destructive Removal of Unrelated Agent Configurations
Content: View full analysis
{ if (a.default === true) return true; // If we have a prefix, only remove agents with that prefix if (prefixPattern) return !prefixPattern.test(a.id); // If default team, remove agents whose id matches any selected role OR old non-prefixed agents return false; // remove all non-main for default team }); ``` The same injected expression is used while rebuilding the main agent allowlist: ```javascript // Update main agent allowAgents const mainIdx = config.agents.list.findIndex(a => a.default === true); if (mainIdx === -1) { config.agents.list.unshift({ id: 'main', default: true, name: 'Main Agent', workspace, subagents: { allowAgents: newAgentIds }, }); } else { if (!config.agents.list[mainIdx].subagents) { config.agents.list[mainIdx].subagents = {}; } // Merge with existing allowAgents (other teams' agents) const existing = config.agents.list[mainIdx].subagents.allowAgents || []; const merged = [...new Set([...existing.filter(id => { // Keep agents from other teams if (prefixPattern) return !prefixPattern.test(id); return false; }), ...newAgentIds])]; config.agents.list[mainIdx].subagents.allowAgents = merged; } ``` ### Technical Analysis `teamName` is user-controlled, and `teamPrefix` is derived from it without escaping regular-expression metacharacters. Constructing `new RegExp(\`^${teamPrefix}\`)` therefore allows the team name to alter the expression's meaning. For ...[truncated 2644 chars]
Remediation: View remediation
id.startsWith(teamPrefix); ``` 2. If a regular expression is unavoidable, strictly validate the identifier and escape every regex metacharacter before constructing it. 3. Add an explicit immutable `team` property to each generated agent entry and remove agents by exact ownership: ```javascript config.agents.list = config.agents.list.filter( agent => agent.default === true || agent.team !== teamName ); ``` 4. For the default team, remove only agents recorded in the previous default-team manifest. Never interpret “default” as ownership of every non-default agent. 5. Compute and display a configuration diff before writing, including every agent and allowlist entry scheduled for removal. 6. Require explicit confirmation if the operation would remove agents not present in the selected team's existing manifest. 7. Abort if the number of removed agents exceeds the expected number for the selected team. 8. Write configuration atomically to a temporary file, validate its schema and invariants, then rename it into place. 9. Automatically restore the backup if validation or writing fails. 10. Add regression tests covering team names with `.`, `*`, `+`, `?`, `|`, parentheses, brackets, anchors, and backslashes, as well as coexistence between default and named teams. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README advertises automatic modification of openclaw.json, workspaces, manifests, and setup of a recurring optimization cron, but it does not clearly warn users that running the wizard changes local files and may install persistent scheduled behavior. In an agent skill context, undisclosed state changes and persistence increase the chance of unsafe execution, accidental configuration drift, or abuse by a downstream script that performs broader modifications than the documentation suggests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The document is explicitly structured around English and Chinese sections and the activation examples include language-specific commands, but it does not state that users may choose their preferred language or that the skill is limited to a specific locale for compliance reasons. Under the policy, forcing a specific language without opt-in can be a locale policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly requires per-agent skill usage telemetry including agent_id + skill_name + timestamp + context without any notice, consent mechanism, minimization guidance, or restriction on what may appear in context. Because this applies across agents and workflows, it can silently collect sensitive user or project data and normalize privacy-invasive monitoring.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Taken together, the telemetry and archival requirements create a broad data collection and retention pipeline across all teams, explicitly logging usage context and preserving optimization artifacts. In a multi-agent development environment, that context may contain credentials, proprietary code, incident details, or personal data, making the skill materially more dangerous than a generic logging suggestion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill mandates saving weekly optimization summaries to memory/YYYY-MM-DD.md and keeping optimization history under .lib/skill_analytics/ with no retention or sensitivity controls. Persistent archival of operational summaries can accumulate sensitive prompts, project details, and behavioral metadata over time, increasing exposure in the event of local compromise or overbroad access.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The Chinese section repeats the same mandatory cross-team tracking, optimization, and archival instructions, confirming this is not an incidental translation artifact but a deliberate feature of the skill. The bilingual duplication broadens the chance of deployment and reinforces persistent storage of potentially sensitive usage context across current and future teams.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file contains English metadata and model labels alongside Chinese descriptions and responsibilities, effectively imposing mixed locale output without any opt-in or documented language selection. This can violate language/locale policy when users are not given a choice of interface or content language.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This is a manifest JSON file, so vague-trigger checks apply. The note says users can define "fully custom roles via the wizard" but gives no constraints, trigger scope, or exclusion conditions for what qualifies as an acceptable custom role, which makes invocation/activation boundaries ambiguous.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The collaboration and notes sections contain instructions written only in Chinese, which imposes a specific language on downstream skill authors and users without offering a language choice or documenting a justified locale constraint. This matches the policy category for language or locale restrictions in natural-language content.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
- Set up a multi-role collaborative development team (2–10 agents) - Need multiple teams to work in parallel with independent configurations - Need custom collaboration workflows (not limited to standard 9-step) - Need flexible role combinations and model assignments ### Quick Start

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The user-facing prompt Team name (用于区分多个团队) embeds Chinese text in the interactive flow, which imposes a specific language/locale in at least part of the skill experience. There is no surrounding language selection or opt-in mechanism to let users choose their preferred locale.
Content: No source excerpt is available for this finding.