ClawHub
Back to skill

Security audit

Config Preflight Validator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward OpenClaw configuration validator with disclosed local schema caching, though users should not treat its fallback checks as complete validation.

Install this only if you are comfortable with a Chinese-language helper that invokes the local OpenClaw CLI to fetch schema data and caches that schema under your home directory. For important configuration changes, ensure `jsonschema` is installed and a live or cached schema is available; otherwise the tool only performs limited checks and may overstate confidence.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/config-preflight-validator.py:43
Finding

Schema Validation Fails Open When No Schema Is Available

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:39
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises and instructs shell execution plus reads from and writes to local files, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may invoke broader capabilities than a reviewer or runtime policy expects, increasing the risk of unintended file access or command execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description and main body are written in Chinese, which imposes a specific language on users. There is no indication that the skill supports other languages, offers opt-in language selection, or is restricted to a justified Chinese-only context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file's top-level documentation and CLI descriptions are entirely in Chinese, and the script's output strings continue this language assumption throughout the file. This imposes a specific language on users without opt-in or documentation that the tool is intended only for a Chinese-speaking or region-specific environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script is described as a local preflight validator, but it silently reaches out through the OpenClaw CLI and persists returned data under the user's home directory. This violates least surprise and expands the trust boundary: a compromised or unexpected CLI/backend response could influence validation behavior or leave persistent artifacts without explicit user approval.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

For a validator whose stated purpose is local configuration checking, subprocess-based gateway access introduces unnecessary capability and an avoidable dependency on external behavior. In this context, the extra capability increases attack surface and can cause unintended network/service interaction, making the skill more dangerous than its description suggests.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/config-preflight-validator.py (reported line 28)May include surrounding context.

python
import subprocess
    try:
        # 优先使用 openclaw CLI 获取
        result = subprocess.run(["openclaw", "gateway", "config.schema"], capture_output=True, text=True, timeout=5)
        if result.returncode == 0:
            schema = json.loads(result.stdout)
            # 缓存一份