Back to skill

Security audit

Openclaw Health Audit

Security checks for vulnerabilities and agentic risk

Overview

This health-audit skill is mostly coherent, but it can persistently schedule itself and broadly rewrite or delete OpenClaw session and cron state beyond what users may expect.

Review this skill carefully before installing. It is suitable only if you want a Chinese-language OpenClaw maintenance tool that can inspect local OpenClaw state, create a recurring health-check cron job, and perform broad repairs. Avoid `--fix all` until you have backups of `~/.openclaw/cron/jobs.json` and `~/.openclaw/workspace/.lib/session_model_state.json`, and manually verify any proposed provider or model routing changes.

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T06 · System Persistence

Error
Location
scripts/audit_wizard.py:122
Finding

Persistent Agent Cron Job Is Registered by Default

Content
View full analysis
str: """注册 48h 健康检查 Cron Job,返回 Job ID""" if not CRON_JOBS.exists(): print(f' ⚠️ Cron Job 文件不存在:{CRON_JOBS},跳过注册') return '' with open(CRON_JOBS) as f: jobs_data = json.load(f) is_list = isinstance(jobs_data, list) jobs = jobs_data if is_list else jobs_data.get('jobs', list(jobs_data.values())) for job in jobs: if 'health' in job.get('name', '').lower() and 'monitor' in job.get('name', '').lower(): return job.get('id', '') job_id = str(uuid.uuid4()) skill_dir = str(SKILL_DIR) new_job = { "id": job_id, "name": "48h-health-monitor", "schedule": "0 2 */2 * *", "sessionKey": None, "status": "active", "payload": { "kind": "agentTurn", "model": model, "timeoutSeconds": 120, "prompt": ( f"执行系统健康检查:python3 {skill_dir}/scripts/health_monitor.py --report\n\n" "将输出结果通过 Telegram 发送给用户。若有问题,等待用户回复后按指令执行修复。\n" "修复命令格式:python3 {skill_dir}/scripts/health_monitor.py --fix <编号或 all>" ).replace('{skill_dir}', skill_dir) } } if is_list: jobs_data.append(new_job) else: jobs_data[job_id] = new_job with open(CRON_JOBS, 'w') as f: json.dump(jobs_data, f, indent=2, ensure_ascii=False) return job_id ``` ```python if ask_yn('\n是否注册 48h 定期健康检查 Cron Job', default=True): model = ask(' 使用模型', DEFAULT_CHEAP_MODEL) register_cron_job(model) ``` ### Technical Analysis The installation wizard directly modifies `~/.openclaw/cron/jobs.json` to add an active `agentTu ...[truncated 1368 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/health_monitor.py:712
Finding

Orphan-Session Repair Deletes All Stale Session State Regardless of Session Type

Content
View full analysis
list[Issue]: """C: 检查孤儿 Session(超过 7 天无活动的 cron session)""" issues = [] if not SESSION_STATE.exists(): return issues with open(SESSION_STATE) as f: sessions = json.load(f) now_ms = int(time.time() * 1000) stale_ms = SESSION_STALE_DAYS * 24 * 3600 * 1000 stale = [] for key, state in sessions.items(): ts = state.get('lastPatchedAt', state.get('updatedAt', 0)) if ts and (now_ms - ts) > stale_ms: age_days = (now_ms - ts) / (24 * 3600 * 1000) stale.append((key, age_days)) ``` ```python def _fix_orphan_sessions(): """清理过期 Session""" with open(SESSION_STATE) as f: sessions = json.load(f) now_ms = int(time.time() * 1000) stale_ms = SESSION_STALE_DAYS * 24 * 3600 * 1000 keys_to_remove = [ k for k, v in sessions.items() if (ts := v.get('lastPatchedAt', v.get('updatedAt', 0))) and (now_ms - ts) > stale_ms ] for k in keys_to_remove: del sessions[k] with open(SESSION_STATE, 'w') as f: json.dump(sessions, f, indent=2, ensure_ascii=False) print(f' ✅ 清理了 {len(keys_to_remove)} 个过期 Session: {keys_to_remove}') ``` ### Technical Analysis The function documentation states that it identifies stale Cron sessions, but neither detection nor repair checks whether a key belongs to a Cron task. The only condition is that `lastPatchedAt` or `updatedAt` is older than the configured threshold. Consequently, `--fix all` can remove persistent entries for user conversations, channel sessions, sub-agents, or other session classes. The operation rewrites the original state file without an atomic update, backup, or recovery mechanism. This also conflicts with the Skill declarati ...[truncated 951 chars]
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/health_monitor.py:675
Finding

Cron Repair Redirects Unrelated Jobs to a Hard-Coded Model Provider

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/health_monitor.py:734
Finding

Session Integrity Repair Injects Hard-Coded Provider Routes Across All Sessions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/health_monitor.py:808
Finding

Dry-Run Mode Overwrites a Persistent Report File

Content
View full analysis
0 and args[i-1] == '--fix': fix_all = True if 'all' in args and '--fix' in args: fix_all = True list_fixes = '--list-fixes' in args issues = collect_all_issues() should_report = do_report or (not fix_arg and not list_fixes) if should_report: report = format_report(issues, dry_run=dry_run) print(report) REPORT_FILE.write_text(report) ``` The corresponding documentation states: ```bash # Preview the report without modifying any files python3 {skill_dir}/scripts/health_monitor.py --dry-run ``` ### Technical Analysis The `dry_run` flag changes report labeling and prevents selected repair functions from executing, but it does not guard the `REPORT_FILE.write_text(report)` operation. Every dry run therefore overwrites `~/.openclaw/workspace/.lib/health_report_latest.md`. This violates the safety property promised by the command documentation. It can also erase the previous report that a user may expect to preserve for comparison or incident analysis. ### Attack Path 1. A user invokes the documented `--dry-run` command expecting no filesystem changes. 2. The monitor collects findings and formats a report. 3. The unconditional `write_text()` call replaces the existing report file. 4. The prior report contents are lost unless separately backed up. ### Impact Assessment The issue permits modification of one persisten ...[truncated 282 chars]
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (31)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
**What this skill does NOT do:**
- Does NOT delete or modify user data
- Does NOT access API keys directly
- Does NOT send data to external servers
- Does NOT run with elevated (sudo/root) privileges

## 首次安装

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README advertises auto-repair and --fix operations that can modify configuration, cron state, and session-related files, but it does not clearly warn users about the scope of changes, possible side effects, or the need to review actions before execution. In a security-sensitive automation context, undocumented write/repair behavior increases the risk of accidental system changes, privilege misuse, or service disruption if an agent or user runs the commands blindly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README promises automatic cleanup of sessions older than 7 days using definitive language like '彻底清除' without any warning about irreversible deletion, backup expectations, or how activity is determined. In an operational agent environment, users may enable this behavior assuming it is routine maintenance, which can lead to accidental loss of historical state, debugging context, or still-needed sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The one-click commands 'health fix all' and targeted auto-fix actions are described as convenience operations that automatically change Cron isolation and clean sessions, but the documentation does not warn that these actions can modify scheduling behavior or delete state. Framing system-impacting remediation as a simple fix increases the chance of unsafe execution in production without review, rollback planning, or operator confirmation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file presents all installation and operational guidance exclusively in Chinese, including commands context and safety-relevant usage notes. Under the language/locale policy rule, forcing a single language without user opt-in or justification can be a policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises privileged behaviors such as reading local config/logs, running Python scripts, and updating Cron Job settings, but it does not declare an explicit machine-readable tool scope like permissions or allowed-tools. This creates a governance gap: the agent may be allowed to invoke broader file, shell, and write capabilities than users or the platform can easily audit, increasing the risk of unintended file access or state-changing commands.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

Natural-language policy checks apply to all file types. The skill's user-facing description, setup steps, report format, and command guidance are predominantly presented in Chinese, which can impose a specific language experience without documenting user choice or a justified locale restriction.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
**What this skill does NOT do:**
- Does NOT delete or modify user data
- Does NOT access API keys directly
- Does NOT send data to external servers
- Does NOT run with elevated (sudo/root) privileges

## 首次安装

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases include broad terms like "audit" and "health check," which can cause the skill to activate in unrelated contexts and perform sensitive inspection actions on local configs, logs, or cron state. Because this skill can also run repair commands, overbroad activation increases the chance of accidental invocation and unintended system changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description is broad enough to match many operational contexts: 'system health audit & auto-fix' and the Chinese text about monitoring prompt volume, Cron compliance, session cleanup, and token consumption suggest sweeping administrative actions. In agent ecosystems, vague trigger descriptions can cause unintended invocation on unrelated tasks, which is risky because the skill appears capable of auditing and modifying system state automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file contains user-facing guidance exclusively in Chinese, and there is no indication that the skill or document is intentionally limited to Chinese-speaking users or a China-specific context. Under the language/locale policy, forcing a single language without opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring and usage text are written entirely in Chinese, and later prompts shown to the user are also Chinese-only. This creates a language/locale constraint without opt-in or documented justification, which matches the policy-violation category for forced language behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The installer modifies the user's persistent cron/jobs configuration by registering an agentTurn job that will run every 48 hours and send output onward, which expands the skill from local auditing into autonomous scheduled behavior. Even though it is user-prompted, this creates persistence and recurring execution capability that can be abused if the downstream monitor script or agent prompt path is unsafe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The wizard writes directly to the user's jobs file to create a persistent scheduled task, while the skill description does not clearly disclose that installation can alter recurring automation state. This undermines informed consent and can hide persistence in an ostensibly health-audit utility, increasing the risk of unnoticed recurring execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

该技能的目的聚焦于健康审计与修复配置,但此文件在向导末尾通过 subprocess.run 启动另一个脚本。虽然用于 dry-run 验证,但“生成配置/安装向导”本身并不天然需要具备进程执行能力,这是一种更强的本地执行权限。

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/audit_wizard.py (reported line 274)May include surrounding context.

python
print()
        monitor_path = SKILL_DIR / 'scripts' / 'health_monitor.py'
        import subprocess
        result = subprocess.run(
            [sys.executable, str(monitor_path), '--dry-run'],
            capture_output=False
        )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring, usage instructions, and operational messages are entirely in Chinese, which effectively imposes a specific language/locale on users without opt-in or alternative language support. The policy requires either user choice or a clearly justified locale constraint, neither of which is stated here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The declared skill purpose is health auditing, but the implemented scope includes broad code/config integrity inspection of unrelated files such as message-injector code, pools.json, and openclaw.json. In an agent ecosystem, this wider-than-advertised access increases the chance that operators grant the skill more trust and permissions than intended, enabling sensitive environment reconnaissance and setting up later modification paths.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/health_monitor.py (reported line 285)May include surrounding context.

python
# 尝试调用 openclaw gateway usage-cost --json
    try:
        result = subprocess.run(
            ['openclaw', 'gateway', 'usage-cost', '--json', '--days', '2'],
            capture_output=True, text=True, timeout=15
        )

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script does not only monitor health; it can automatically rewrite cron jobs, delete session entries, and alter fallback chains in multiple persistent files. Automatic state-changing remediation across core config files is dangerous because a user invoking a 'health audit' may not expect destructive or policy-altering changes, and compromised findings logic could silently degrade availability or integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The fix routines perform persistent file edits and deletions, including removing session keys and rewriting configuration, without an in-band confirmation prompt at execution time or mandatory backup creation. In a security-sensitive agent environment, this can cause accidental data loss, availability issues, or stealthy tampering if the script is triggered under mistaken assumptions about being a read-only health check.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file is entirely written as a template in Chinese and instructs creation of new SOUL.md files using Chinese guidance, but it does not indicate that language selection is optional or limited to a China-specific context. This can violate a language/locale policy when a skill template implicitly enforces one language for all downstream agent identities and instructions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The cron template goes beyond passive health auditing by instructing the agent to send results over Telegram and then execute repair commands based on subsequent user replies. This expands the skill from monitoring into remote action execution, increasing the attack surface and creating a path for unintended or unsafe fixes to be triggered through chat-driven workflows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Outbound Telegram messaging introduces an external data exfiltration channel that is not necessary for a basic health-audit template. Health-check output may contain operational details, paths, error logs, or other sensitive metadata that should not be sent to third-party messaging systems without clear justification and controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The follow-up phrases for triggering fixes are simple natural-language commands, which makes repair execution dependent on ambiguous conversational input rather than a hardened control path. In an agent environment, this can enable accidental activation, spoofed replies, or prompt-driven manipulation that causes the system to run remediation commands without sufficient verification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.