ClawHub
Back to skill

Security audit

claw-security-panel

Security checks for vulnerabilities and agentic risk

Overview

This security-panel skill has a coherent goal, but its startup path and local reporting design create serious local execution and sensitive-data exposure risks.

Do not run this skill as-is on a shared or privileged machine. It may inspect sensitive host logs, shell history, credential-like files, and OpenClaw data, then write reports and token-bearing pages under /tmp; worse, its launcher executes a server file from /tmp that is not included in the reviewed package.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
start.sh:34
Finding

Execution of an Untrusted Server Script from a Shared Temporary Directory

Content
View full analysis
/tmp/security_panel.log 2>&1 & SERVER_PID=$! echo $SERVER_PID > /tmp/security_panel.pid ``` ### Technical Analysis The launcher executes `/tmp/security_panel_server.py`, but that file is neither included in the audited project nor generated by `scripts/security_check.py`. The implementation therefore relies on an unauthenticated file at a predictable path in a globally writable temporary directory. A local attacker can create this file before the Skill starts. When the launcher subsequently invokes Python, the attacker's code executes with the privileges of the account running the Skill. If the Skill is run as an administrative account, the payload receives those elevated privileges. This also means the actual HTTP server and `/api/fix` implementation are outside the reviewed package, preventing the advertised panel and automatic remediation behavior from being independently verified. ### Attack Path 1. A local attacker creates `/tmp/security_panel_server.py`. 2. The attacker places arbitrary Python code in that file. 3. A victim invokes `start.sh`. 4. The launcher runs the attacker-controlled file with Python. 5. The payload inherits the victim's user privileges and can access the victim's OpenClaw files, workspace, reports, and credentials. 6. Because the process is launched through `nohup`, the malicious process may continue running after the launching shell exits, although this does not establish reboot persistence. ### Impact Assessment Successful exploitation provides arbitrary code execution as the Skill user. The attacker may read or modify OpenClaw configuration, workspace data, generated security reports, and any other resources ...[truncated 324 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
start.sh:25
Finding

Predictable Temporary Files Permit Symlink, Report-Tampering, and PID-File Attacks

Content
View full analysis
/dev/null; then echo "🔄 Stopping old service (PID: $OLD_PID)..." kill $OLD_PID 2>/dev/null || true sleep 1 fi fi # Start the new server echo "🚀 Starting security panel service..." nohup python3 /tmp/security_panel_server.py "$TOKEN" "$PORT" > /tmp/security_panel.log 2>&1 & SERVER_PID=$! echo $SERVER_PID > /tmp/security_panel.pid ``` ```python parser = argparse.ArgumentParser() parser.add_argument('--output', default='/tmp/security_report.json') args = parser.parse_args() token = str(uuid.uuid4()) report = run_security_check() report_path = Path(args.output) report_path.write_text(json.dumps(report, indent=2, ensure_ascii=False)) # Generate the main page main_html = generate_main_page(report, token) main_path = Path('/tmp/claw_security_pannel.html') main_path.write_text(main_html, encoding='utf-8') # Generate the risks page risks_html = generate_risks_page(report, token) risks_path = Path('/tmp/claw_security_pannel_risks.html') risks_path.write_text(risks_html, encoding='utf-8') ``` ### Technical Analysis The Skill uses fixed, predictable names in `/tmp` for its report, HTML pages, log, executable server, and PID file. These paths are used without exclusive creation, symbolic-link rejection, ownership validation, or a private per-run directory. `Path.write_text()` follows symbolic links. An attacker who pre-creates one of the expected paths as a symbolic link can cause the Skill to overwrite another file writable by the victim. The same paths can also be populated with attacker-controlled content before execution, resulting in report or panel tampering. The ...[truncated 1568 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/security_check.py:1372
Finding

Stored Script Injection Through Unescaped Report Data Embedded in HTML

Content
View full analysis
Detailed information:
    ' for d in details: details_html += f'
  • {d.get("file", "")}:{d.get("line", "")} - {d.get("pattern", "")}
    • ' details_html += '
' ``` The complete report is inserted directly into an executable script block: ```html ` can terminate the script element even when it appears inside a JavaScri ...[truncated 1722 chars]
Remediation
View remediation
` block. - Serve the report through the authenticated JSON API and retrieve it with same-origin `fetch`. - If inline data is unavoidable: - Encode `<`, `>`, `&`, Unicode line separator, and Unicode paragraph separator safely. - Replace `<` with `\u003c` before insertion into HTML. - Place data in a non-executable element and parse validated text. - Escape all values inserted into HTML with `html.escape(..., quote=True)`. - Build page elements through safe DOM methods such as `textContent` instead of string concatenation or `innerHTML`. - Add a restrictive Content Security Policy that disallows inline scripts. - Validate and constrain all report fields before rendering. - Treat shell history, log data, filenames, IP-related strings, and configuration content as untrusted input. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/security_check.py:1420
Finding

Sensitive Security-Reconnaissance Data Written to Predictable Temporary Reports

Content
View full analysis
1024 * 1024: continue try: content = filepath.read_text().lower() for pattern in SENSITIVE_PATTERNS: if pattern in content: lines = filepath.read_text().split('\n') for i, line in enumerate(lines, 1): if patt ...[truncated 3791 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (28)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill metadata promises chat-triggered security checks and remediation workflows, but the analyzed behavior suggests a CLI script that launches an HTTP server and manages PID/log files without clearly declaring that operational behavior. Undeclared process spawning and service exposure increase risk because they can leave background services running and broaden attack surface unexpectedly.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill metadata promises chat-triggered security checks and remediation workflows, but the analyzed behavior suggests a CLI script that launches an HTTP server and manages PID/log files without clearly declaring that operational behavior. Undeclared process spawning and service exposure increase risk because they can leave background services running and broaden attack surface unexpectedly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill claims to assess OpenClaw security but also inspects host-system login history, which broadens collection into unrelated and sensitive system telemetry. This mismatch increases the chance of covert surveillance, privacy violations, and overbroad data exposure to whoever can access the generated report.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill uses privileged host-audit mechanisms (sudo, auth logs, last) that are not necessary for a normal security-panel workflow. If misused or triggered unexpectedly, this can expose sensitive login records and create a precedent for elevated local access inside an agent skill.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

This duplicate finding points to the same auto-fix command generation for permission changes on critical files. The danger is that a downstream component may treat this as trusted executable remediation, causing unintended or unsafe changes to local files.

Content

Scanner excerpt · scripts/security_check.py (reported line 403)May include surrounding context.

python
'issue': '文件可被其他用户写入且无保护声明',
                    'severity': 'high',
                    'suggestion': '移除写权限或添加保护声明',
                    'fix_command': f'chmod o-w {filepath}',
                    'fix_warning': '修复后文件将不可直接修改，需要提升权限编辑',
                    'auto_fixable': True
                })

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

This duplicate finding points to the same auto-fix command generation for permission changes on critical files. The danger is that a downstream component may treat this as trusted executable remediation, causing unintended or unsafe changes to local files.

Content

Scanner excerpt · scripts/security_check.py (reported line 403)May include surrounding context.

python
'issue': '文件可被其他用户写入且无保护声明',
                    'severity': 'high',
                    'suggestion': '移除写权限或添加保护声明',
                    'fix_command': f'chmod o-w {filepath}',
                    'fix_warning': '修复后文件将不可直接修改,需要提升权限编辑',
                    'auto_fixable': True
                })

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The skill scans .env and other local files for credential-like material, which means it deliberately reads likely secret-bearing sources far beyond a narrow OpenClaw health check. Even if intended for security auditing, this behavior can collect, expose, or mishandle credentials, especially when combined with report generation and /tmp output.

Content

Scanner excerpt · scripts/security_check.py (reported line 453)May include surrounding context.

python
if not check_dir.exists():
            continue
        
        for ext in ['*.json', '*.txt', '*.md', '*.yaml', '*.yml', '*.env']:
            for filepath in check_dir.glob(ext):
                if filepath.is_symlink() or filepath.stat().st_size > 1024 * 1024:
                    continue

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises capabilities that imply file reads/writes, network serving, and shell access but declares no tool scope or permission boundaries. In an agent environment, this creates excessive implicit authority and makes it hard to constrain or audit sensitive actions such as scanning logs, modifying files, or launching services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrase “安全检查” is generic enough to match ordinary conversation and may invoke a sensitive auditing skill unintentionally. Because this skill inspects local security posture and potentially sensitive logs/history, accidental activation increases privacy and operational risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description does not clearly warn users that it may inspect sensitive local artifacts like login history, command history, installation files, and repository state. This undermines informed consent and can expose highly sensitive operational or personal data during a seemingly routine 'security check'.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/security_check.py (reported line 36)May include surrounding context.

python
def get_openclaw_version():
    """获取 OpenClaw 版本"""
    try:
        result = subprocess.run(['openclaw', '--version'], stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True, timeout=5)
        match = re.search(r'(\d+\.\d+\.\d+)', result.stdout)
        return match.group(1) if match else 'unknown'
    except:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/security_check.py (reported line 45)May include surrounding context.

python
def find_gateway_port():
    """查找 gateway 运行的端口"""
    try:
        result = subprocess.run(['openclaw', 'gateway', 'status'], stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True, timeout=5)
        for line in result.stdout.split('\n'):
            if 'port' in line.lower():
                match = re.search(r':(\d+)', line)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/security_check.py (reported line 101)May include surrounding context.

python
def find_gateway_port():
    """查找 gateway 运行的端口"""
    try:
        result = subprocess.run(['openclaw', 'gateway', 'status'], stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True, timeout=5)
        for line in result.stdout.split('\n'):
            if 'port' in line.lower():
                match = re.search(r':(\d+)', line)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
96% confidence
Finding

This code invokes sudo tail /var/log/auth.log, giving the skill privileged visibility into system authentication logs. That exceeds the stated purpose of an OpenClaw security panel, can expose sensitive host login activity, and normalizes privilege escalation from a user-triggered skill.

Content

Scanner excerpt · scripts/security_check.py (reported line 223)May include surrounding context.

python
if auth_log.exists():
            try:
                content = subprocess.run(['sudo', 'tail', '-200', str(auth_log)], 
                                        stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True, timeout=5).stdout
                for line in content.split('\n'):
                    if 'Accepted' in line or 'session opened' in line:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/security_check.py (reported line 245)May include surrounding context.

python
# 同时检查 last 命令输出
        try:
            result = subprocess.run(['last', '-20'], stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True, timeout=5)
            if result.returncode == 0:
                for line in result.stdout.split('\n'):
                    if line and len(line) > 40 and 'reboot' not in line.lower():

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/security_check.py (reported line 328)May include surrounding context.

python
"""检查运行用户权限"""
    issues = []
    try:
        current_user = subprocess.run(['whoami'], stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True, timeout=3).stdout.strip()
        if current_user == 'root':
            issues.append({
                'id': f'user_{uuid.uuid4().hex[:8]}',

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/security_check.py (reported line 383)May include surrounding context.

python
try:
            content = filepath.read_text()
            mode = filepath.stat().st_mode
            is_world_writable = mode & 0o002
            
            # 检查是否包含防修改声明
            has_protection = any([

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/security_check.py (reported line 394)May include surrounding context.

python
try:
            content = filepath.read_text()
            mode = filepath.stat().st_mode
            is_world_writable = mode & 0o002
            
            # 检查是否包含防修改声明
            has_protection = any([

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code claims to inspect only the last 3 days of command history but actually scans entire history files without time filtering. That causes over-collection of potentially sensitive shell activity and misleads users about the scope of surveillance.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/security_check.py (reported line 720)May include surrounding context.

python
"""检查登录 IP 异常"""
    issues = []
    try:
        result = subprocess.run(['last', '-n', '10'], stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=True, timeout=5)
        if result.returncode == 0:
            ips = set()
            for line in result.stdout.strip().split('\n'):

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The risk-details page embeds the entire report object into client-side JavaScript, including potentially sensitive file paths, login IPs, and command-history findings. Any party that can fetch or view the page gains access to more raw data than needed for rendering, increasing disclosure risk if the token leaks or files are exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script writes sensitive findings, tokens, and generated HTML reports to predictable /tmp paths, which are often world-readable on multi-user systems. Because the report may include login IPs, command history, and file paths, local users could read or race these files and obtain confidential security data or access tokens.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code kills an existing process from a PID file and writes new state to /tmp files, including the PID, log, and report. While it prints status messages, it does not clearly disclose to the user that an existing service will be terminated and temporary files will be overwritten or created, which is a safety-relevant side effect for a code file.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · start.sh (reported line 37)May include surrounding context.

sh
# 启动新的服务器
echo "🚀 启动安全面板服务..."
nohup python3 /tmp/security_panel_server.py "$TOKEN" "$PORT" > /tmp/security_panel.log 2>&1 &
SERVER_PID=$!
echo $SERVER_PID > /tmp/security_panel.pid

Vague Triggers

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The trigger rules do not define when the skill must not run, so there are no scope boundaries to prevent accidental invocation in unrelated contexts. For a skill that inspects local state and may offer remediation, missing exclusions can cause unnecessary or surprising access to sensitive data.

Content

No source excerpt is available for this finding.