Security audit

Config Modification

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local OpenClaw config guard, but its automatic watcher and rollback workflow have material scoping, secret-exposure, and recovery-safety issues users should review before installing.

Install only if you are comfortable with a persistent local watcher that can automatically modify OpenClaw configuration and restart the Gateway. Before production use, require explicit path scoping to ~/.openclaw, redact diff output for token/password/API-key fields, bind snapshots and rollback to the exact validated file, and change validation infrastructure failures to fail closed rather than accepting the change.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: quad_check.py:290
Finding: Sensitive Configuration Values Are Exposed Through Diff Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: auto_rollback.py:255
Finding: Snapshot and Rollback Operations Are Not Bound to the Validated Configuration Path
Content: View full analysis
int: """完整修改周期: snapshot → intercept → check → verify""" print(f"\n{'='*60}") print(f" 🔒 Config Modification Safety System v2.4") print(f" Powered by halfmoon82 — 知识产权声明") print(f"{'='*60}") print(f"\n配置文件: {config_path}") # Step 1: 创建快照 print("\n[1/4] 📸 创建快照...") import subprocess result = subprocess.run( ["python3", BACKUP_SCRIPT, "snapshot"], capture_output=True, text=True ) ``` Validation failures pass `config_path` into the rollback controller: ```python if summary['failed'] > 0: print("⚠️ 校验失败，触发自动回滚...") controller = AutoRollback() controller.check_and_rollback(results, config_path) print("❌ 修改周期失败") return 1 ``` However, `_execute_rollback()` ignores its `config_path` argument when invoking the external helper: ```python def _execute_rollback(self, config_path: str) -> bool: """执行回滚""" print(f"\n🔄 正在执行自动回滚: {config_path}") try: result = subprocess.run( ["python3", str(self.rollback_script), "rollback"], capture_output=True, text=True, timeout=30 ) ``` ### Technical Analysis The CLI accepts arbitrary absolute paths for the `check` and `full-cycle` commands. The selected path is used during validation, but it is not supplied to either the snapshot or rollback subprocess. Consequently, the displayed and validated target is not cryptographically or logically bound to the recovery operation. The external helper must infer ...[truncated 2794 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: config-fswatch-guard.py:86
Finding: Persistent Configuration Watcher Fails Open When Security Validation Cannot Run
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (34)

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
| Restart OpenClaw Gateway | Apply config changes | Local service only | **What this skill does NOT do:** - Does NOT send data to external servers - Does NOT access credentials or API keys directly - Does NOT modify files outside `~/.openclaw/` - Does NOT run with elevated (sudo/root) privileges

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
**What this skill does NOT do:** - Does NOT send data to external servers - Does NOT access credentials or API keys directly - Does NOT modify files outside `~/.openclaw/` - Does NOT run with elevated (sudo/root) privileges

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README presents the skill entirely in Chinese, including operational instructions and warnings, with no indication that users can choose another language. Per the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation unless the locale limitation is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly promotes automatic rollback after detecting configuration problems, but it does not clearly warn users that their edits may be reverted automatically. In a configuration-management skill, silent rollback can overwrite intentional changes, create confusion during incident response, and potentially restore stale or insecure settings if users do not understand the behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Chinese README tells users to consult the English README for the complete documentation, which makes English the required language for full use of the skill. This is a natural-language policy concern because no language choice or opt-in is offered to Chinese-speaking users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: A large portion of the natural-language instructions and operational guidance is presented in Chinese, and the document does not indicate that language selection is optional or user-configurable. This can violate a language/locale policy when users are not given an explicit choice.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
| Operation | Purpose | Scope | |-----------|---------|-------| | Read/write `~/.openclaw/openclaw.json` | Validate and protect config changes | Local file only | | Create backup snapshots | Enable rollback on failure | `~/.openclaw/backup/` only | | Run local Python scripts | JSON validation, schema checks, diff | No network access | | Monitor file system via fswatch/kqueue | Detect config changes automatically | Watches only OpenClaw config files |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
| Restart OpenClaw Gateway | Apply config changes | Local service only | **What this skill does NOT do:** - Does NOT send data to external servers - Does NOT access credentials or API keys directly - Does NOT modify files outside `~/.openclaw/` - Does NOT run with elevated (sudo/root) privileges

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill claims it does not access credentials or API keys directly, yet its alerting design references Telegram and Signal notifications, which usually require tokens, bot credentials, or linked local clients. This mismatch is dangerous because operators may trust the declaration and deploy the skill without realizing it depends on external messaging integrations that can expose configuration data or trigger outbound communications.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger conditions are extremely broad and mandatory for essentially any JSON configuration change under ~/.openclaw/, with 'no exceptions.' Overbroad automatic interception and monitoring can cause unintended execution, denial of service to legitimate workflows, or repeated rollback behavior when unrelated files change.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring is entirely in Chinese, including the title, usage guidance, and operational descriptions. This imposes a specific language on users without any visible opt-in, alternative locale, or justification that the skill is region-specific.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list is broad enough to match many ordinary configuration-related requests, which can cause this skill to activate outside its intended scope. Because the skill appears to perform config modification and rollback actions, overbroad routing increases the chance of unintended execution on sensitive configuration tasks.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The rollback API accepts a config_path argument, but _execute_rollback ignores it and always invokes the rollback helper with only a generic 'rollback' command. This can cause the system to roll back the wrong target or a global/default configuration instead of the failed one, creating integrity and availability issues during incident handling.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · auto_rollback.py (reported line 259)May include surrounding context.
python
print(f"\n🔄 正在执行自动回滚: {config_path}") try: result = subprocess.run( ["python3", str(self.rollback_script), "rollback"], capture_output=True, text=True,

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This manifest says the skill 'automatically monitors file changes' and that 'file changes automatically trigger the full process,' but it does not specify which files, directories, or contexts are in scope. Without explicit constraints or exclusion conditions, the trigger condition is ambiguous and could lead to unintended invocation on routine edits.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The top-level documentation says the watcher does three things on config change: validate JSON, roll back on syntax error, and reset a health-check counter. In reality, the implementation additionally loads another skill from disk for "four-check" validation, may trigger automatic rollback based on those results, and explicitly restarts the Gateway after rollback on JSON errors, which materially expands the behavior beyond the stated intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring and operational log messages are written in Chinese, which establishes a fixed language for user-visible behavior. Under the stated policy, forcing a specific language without offering user choice or documenting a justified locale restriction is a natural-language policy violation.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · config-fswatch-guard.py (reported line 127)May include surrounding context.
python
# 立即回滚 _self_writing = True try: result = subprocess.run( ["python3", ROLLBACK_SCRIPT, "rollback"], capture_output=True, text=True, timeout=10 )

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · config-fswatch-guard.py (reported line 154)May include surrounding context.
python
os.path.expanduser("~/.local/share/fnm/node-versions/v24.13.0/installation/bin/openclaw") ) try: result = subprocess.run( [openclaw_bin, "gateway", "restart"], capture_output=True, text=True, timeout=30 )

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code presents its primary description, usage instructions, status messages, and errors in Chinese, which imposes a specific language on users. There is no opt-in, alternate locale, or explanation that the skill is intended only for a Chinese-speaking or region-specific environment.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation claims the tool 'intercepts' configuration modifications, but the implementation only performs checks and possible rollback after actions are already underway or completed. This can create a false sense of enforcement, causing operators or dependent tooling to assume unsafe changes are blocked when they are not, which may allow harmful configuration changes to take effect before detection or rollback.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · config_modification_v2.py (reported line 100)May include surrounding context.
python
# Step 1: 创建快照 print("\n[1/4] 📸 创建快照...") import subprocess result = subprocess.run( ["python3", BACKUP_SCRIPT, "snapshot"], capture_output=True, text=True )

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This Python file presents its module docstring, usage guidance, and operational descriptions entirely in Chinese, which can constitute a language policy violation when no user opt-in or alternative locale is offered. The rule applies to all file types, including code files, when natural-language strings impose a specific language.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The phase docstring describes two checks: gateway reachability and config writability, but line L357 only says '配置文件可写性' as a health criterion without indicating that writability is mandatory for overall health. In practice, the function returns failure solely because the file is not writable, which expands 'health' from service availability into a write-permission gate for the config path.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · quad_check.py (reported line 362)May include surrounding context.
python
try: # 1. 检查 Gateway 健康 try: result = subprocess.run( ["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}", "http://127.0.0.1:18789/health"], timeout=5, capture_output=True, text=True

Static analysis

No suspicious patterns detected.