Openclaw Security Audit

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:46 AM UTC
• Version: 0.1.3

Overview

This appears to be a legitimate local OpenClaw security audit tool, but it collects and stores broad host and sensitive-file information by default without enough scoping or report-protection controls.

Install only if you are comfortable with a local audit that may inspect OpenClaw config, repository files, env files, logs, workspace memory documents, git-tracked files, and host/network state. Prefer running it in a private workspace, consider using opt-out flags such as --no-host or --no-git when appropriate, and store generated reports in a directory with owner-only permissions because they may reveal host details, paths, listener information, and masked credential fragments.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: resources/runtime/openclaw_sec/cli.py:22

Finding

Default Host and Sensitive-Data Reconnaissance Exceeds Minimum Necessary Scope

Content

View full analysis

tuple[list[Finding], dict[str, object], list[str]]: findings: list[Finding] = [] notes: list[str] = [] host_info = { "hostname": socket.gethostname(), "platform": platform.system(), "platform_release": platform.release(), } ssh_findings, ssh_notes = _scan_ssh_config() findings.extend(ssh_findings) notes.extend(ssh_notes) brute_findings, brute_notes = _scan_bruteforce_hints() findings.extend(brute_findings) notes.extend(brute_notes) firewall_findings, firewall_notes = _scan_firewall() findings.extend(firewall_findi ...[truncated 4533 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: resources/runtime/openclaw_sec/utils.py:40

Finding

Symlink Targets Are Read Before Scan-Boundary Validation

Content

View full analysis

str: if not path.exists() or not path.is_file(): return "" try: if path.stat().st_size > limit: return "" return path.read_text(encoding="utf-8", errors="ignore") except OSError: return "" ``` ```python # resources/runtime/openclaw_sec/utils.py:109-124 def iter_files(root: Path, max_depth: int = 6) -> Iterator[Path]: root = root.expanduser().resolve(strict=False) if not root.exists(): return base_depth = len(root.parts) for current_root, dirnames, filenames in os.walk(root): current_path = Path(current_root) depth = len(current_path.parts) - base_depth dirnames[:] = [dirname for dirname in dirnames if dirname not in IGNORED_DIR_NAMES] if depth >= max_depth: dirnames[:] = [] for filename in filenames: yield current_path / filename ``` ```python # resources/runtime/openclaw_sec/utils.py:178-193 def discover_named_files(roots: Iterable[Path], names: set[str]) -> list[Path]: found: list[Path] = [] for root in roots: if not root.exists(): continue for path in iter_files(root): if path.name in names: found.append(path) return found def discover_suffix_files(roots: Iterable[Path], suffixes: tuple[str, ...]) -> list[Path]: found: list[Path] = [] for root in roots: if not root.exists(): continue for path in iter_files(root): ...[truncated 4324 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: resources/runtime/openclaw_sec/report.py:136

Finding

Sensitive Audit Reports Are Created Without Restrictive Permissions

Content

View full analysis

dict[str, str]: output_dir.mkdir(parents=True, exist_ok=True) paths: dict[str, str] = {} formats = {"text", "json", "md"} if output_format == "all" else {output_format} if "text" in formats: path = output_dir / "summary.txt" path.write_text(render_text(report) + "\n", encoding="utf-8") paths["text"] = str(path) if "json" in formats: path = output_dir / "report.json" path.write_text(render_json(report) + "\n", encoding="utf-8") paths["json"] = str(path) if "md" in formats: path = output_dir / "report.md" path.write_text(render_markdown(report) + "\n", encoding="utf-8") ``` ```python # resources/runtime/openclaw_sec/audit.py:29-49 host_info = { "user": getuser(), } if context.enable_host: network_findings, network_meta, network_notes = scan_network() findings.extend(network_findings) host_findings, system_meta, host_notes = scan_host() findings.extend(host_findings) notes.extend(network_notes) notes.extend(host_notes) host_info.update(system_meta) host_info.update(network_meta) findings = sort_findings(findings) generated_at = datetime.now(timezone.utc).isoformat() summary = summarize_findings(findings) target = { "config_path": str(context.config_path), "workspace_path": str(context.workspace_path) if context.workspace_path else None, "current_dir": str(context.current_dir), "git_root": git_meta.get("git_root"), ``` ```python # resources/runtime/openclaw_ ...[truncated 2704 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (27)

Instruction Override

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · resources/runtime/openclaw_sec/cli.py (reported line 25)May include surrounding context.

python

audit_parser.add_argument("--no-git", action="store_true", help="Skip git tracked file scan")
    audit_parser.add_argument("--no-host", action="store_true", help="Skip host and network checks")
    audit_parser.add_argument("--strict", action="store_true", help="Exit non-zero if high or critical findings exist")
    audit_parser.add_argument("--debug", action="store_true", help="Enable debug mode")
    return parser

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/fs_scan.py (reported line 21)May include surrounding context.

python

)


ENV_NAMES = {".env", ".env.local"}
LOG_SUFFIXES = (".jsonl", ".log")
WORKSPACE_DOCS = {"MEMORY.md", "AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md", "USER.md", "HEARTBEAT.md"}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/fs_scan.py (reported line 38)May include surrounding context.

python

)


ENV_NAMES = {".env", ".env.local"}
LOG_SUFFIXES = (".jsonl", ".log")
WORKSPACE_DOCS = {"MEMORY.md", "AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md", "USER.md", "HEARTBEAT.md"}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/secret_scan.py (reported line 28)May include surrounding context.

python

)


ENV_NAMES = {".env", ".env.local"}
LOG_SUFFIXES = (".jsonl", ".log")
WORKSPACE_DOCS = {"MEMORY.md", "AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md", "USER.md", "HEARTBEAT.md"}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/secret_scan.py (reported line 72)May include surrounding context.

python

)


ENV_NAMES = {".env", ".env.local"}
LOG_SUFFIXES = (".jsonl", ".log")
WORKSPACE_DOCS = {"MEMORY.md", "AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md", "USER.md", "HEARTBEAT.md"}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/fs_scan.py (reported line 21)May include surrounding context.

python

)


ENV_NAMES = {".env", ".env.local"}
LOG_SUFFIXES = (".jsonl", ".log")
WORKSPACE_DOCS = {"MEMORY.md", "AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md", "USER.md", "HEARTBEAT.md"}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/secret_scan.py (reported line 28)May include surrounding context.

python

)


ENV_NAMES = {".env", ".env.local"}
LOG_SUFFIXES = (".jsonl", ".log")
WORKSPACE_DOCS = {"MEMORY.md", "AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md", "USER.md", "HEARTBEAT.md"}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/secret_scan.py (reported line 86)May include surrounding context.

python

heuristic=False,
            evidence=matches["evidence"],
            risk="Environment files often end up in shells, backups, or repos and should not store high-value secrets in plaintext.",
            recommendation="Move secrets into a proper secret manager or protected host environment, and keep .env files out of version control.",
            masked_examples=matches["masked_examples"],
            references=[".env scanning"],
        )

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/secret_scan.py (reported line 88)May include surrounding context.

python

heuristic=False,
            evidence=matches["evidence"],
            risk="Environment files often end up in shells, backups, or repos and should not store high-value secrets in plaintext.",
            recommendation="Move secrets into a proper secret manager or protected host environment, and keep .env files out of version control.",
            masked_examples=matches["masked_examples"],
            references=[".env scanning"],
        )

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code unconditionally collects the current OS username via getuser() and includes it in the generated audit report. Usernames are sensitive host-identifying metadata that can expose operator identity, leak environment details, and create privacy issues if reports are shared, uploaded, or stored centrally without explicit disclosure or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

When enable_host is set, the function performs network and host scans and merges the resulting metadata into the audit report, but this file shows no user-facing disclosure, scoping, or minimization controls. Such scans can gather sensitive system and network details that materially increase exposure if reports are exfiltrated, shared, or run in environments where the operator did not understand the breadth of collection.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/fs_scan.py (reported line 12)May include surrounding context.

python

find_secret_hits,
    is_group_readable,
    is_group_writable,
    is_world_readable,
    is_world_writable,
    path_outside_base,
    permission_bits,

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/fs_scan.py (reported line 52)May include surrounding context.

python

find_secret_hits,
    is_group_readable,
    is_group_writable,
    is_world_readable,
    is_world_writable,
    path_outside_base,
    permission_bits,

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/fs_scan.py (reported line 74)May include surrounding context.

python

find_secret_hits,
    is_group_readable,
    is_group_writable,
    is_world_readable,
    is_world_writable,
    path_outside_base,
    permission_bits,

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/fs_scan.py (reported line 98)May include surrounding context.

python

find_secret_hits,
    is_group_readable,
    is_group_writable,
    is_world_readable,
    is_world_writable,
    path_outside_base,
    permission_bits,

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/fs_scan.py (reported line 126)May include surrounding context.

python

find_secret_hits,
    is_group_readable,
    is_group_writable,
    is_world_readable,
    is_world_writable,
    path_outside_base,
    permission_bits,

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · resources/runtime/openclaw_sec/utils.py (reported line 162)May include surrounding context.

python

find_secret_hits,
    is_group_readable,
    is_group_writable,
    is_world_readable,
    is_world_writable,
    path_outside_base,
    permission_bits,

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/fs_scan.py (reported line 13)May include surrounding context.

python

is_group_readable,
    is_group_writable,
    is_world_readable,
    is_world_writable,
    path_outside_base,
    permission_bits,
    permission_string,

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/fs_scan.py (reported line 52)May include surrounding context.

python

is_group_readable,
    is_group_writable,
    is_world_readable,
    is_world_writable,
    path_outside_base,
    permission_bits,
    permission_string,

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/fs_scan.py (reported line 74)May include surrounding context.

python

is_group_readable,
    is_group_writable,
    is_world_readable,
    is_world_writable,
    path_outside_base,
    permission_bits,
    permission_string,

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/fs_scan.py (reported line 98)May include surrounding context.

python

is_group_readable,
    is_group_writable,
    is_world_readable,
    is_world_writable,
    path_outside_base,
    permission_bits,
    permission_string,

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/fs_scan.py (reported line 126)May include surrounding context.

python

is_group_readable,
    is_group_writable,
    is_world_readable,
    is_world_writable,
    path_outside_base,
    permission_bits,
    permission_string,

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · resources/runtime/openclaw_sec/utils.py (reported line 166)May include surrounding context.

python

is_group_readable,
    is_group_writable,
    is_world_readable,
    is_world_writable,
    path_outside_base,
    permission_bits,
    permission_string,

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · resources/runtime/openclaw_sec/detectors/host_scan.py (reported line 78)May include surrounding context.

python

heuristic=False,
                evidence=[f"PermitRootLogin {permit_root}"],
                risk="Root SSH access removes an isolation layer and raises the impact of brute force or credential theft.",
                recommendation="Set PermitRootLogin no and use sudo from a non-root administrative account.",
                references=["/etc/ssh/sshd_config"],
            )
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · resources/runtime/openclaw_sec/utils.py (reported line 130)May include surrounding context.

python

def run_command(command: list[str], timeout: int = 5) -> CommandResult:
    try:
        completed = subprocess.run(
            command,
            check=False,
            capture_output=True,

Static analysis

No suspicious patterns detected.