ClawHub
Back to skill

Security audit

release-openclaw-maintainer

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marked this skill suspicious because a reported risky Git cleanup could affect the wrong checkout, and part of the analysis was incomplete.

Consider the suspicious verdict and the concrete risk of a failed worktree setup causing a hard reset in the original checkout before installing. The scan is incomplete: Skillspector inspected 11 of 12 components, with one partially inspected, so the results do not establish that all content is safe.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
[main closeout](references/stable-main-closeout.md).

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The hard reset is intended to clean an isolated disposable worktree, which is legitimate for backport probing. However, neither worktree creation nor the subsequent directory change is checked: if creation and directory entry fail, the subshell continues in the original checkout, where cherry-pick and hard reset can modify the wrong branch and discard tracked uncommitted changes.

Content

Scanner excerpt · references/backport-discovery.md (reported line 82)May include surrounding context.

md
cd "$audit_root/baseline"
  git cherry-pick --no-commit "$candidate_sha"
  git diff --check
  git reset --hard HEAD
)
git worktree remove --force "$audit_root/baseline"
rmdir "$audit_root"

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/regular-release.md (reported line 346)May include surrounding context.

md
`sync_beta_to_stable` ledger sync through a release-ledger app token and waits
up to 50 minutes (`RELEASE_NPM_DIST_TAG_SYNC_TIMEOUT_SECONDS`) before verification.
Status changes and five-minute heartbeats identify the run. A still-running sync
fails explicitly without judging the beta floor; inspect that run before resuming.
If its summary reports the token unavailable,
dispatch the sync by hand before the verify runs. For manual work, poll the
registry yourself before the sync or verification. Run postpublish

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
Once a candidate is cut, its base is the operator's decision. Never re-cut
(re-base the candidate on newer `main`) unless Peter explicitly asks for it in
that release. Without asking, cherry-pick already-merged `main` commits onto
the release branch only to fix a confirmed release blocker: a required lane
failing deterministically on the frozen candidate, or an update/install/
publish-bytes defect. Name each cherry-pick in the handoff record. Not allowed:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/preparation.md (reported line 41)May include surrounding context.

md
Shadow is nonmutating. Write aligns the owned root/macOS versions and the
version-generated metadata DAG; add `--android` only when Android is selected.
The controller's manifest is bound to the exact HEAD/worktree.
Check version-bearing package, app plist/Gradle, updating-doc, and Peekaboo
project fields against their platform contract. `appcast.xml` is generated at
macOS publication, not a blanket version-bump target. For fallback correction
tags `vYYYY.M.PATCH-N`, those source version fields remain `YYYY.M.PATCH`;

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/publication-recovery.md (reported line 184)May include surrounding context.

md
versions publicly before final release verification.

With `wait_for_clawhub=false` the parent authorizes the ClawHub child and
does not wait for it. The child publishes on its own and needs no approval.
It revalidates that the parent is still active or succeeded, so a parent that
fails first strands it. Watch the child until every package's
`versions/<version>` returns 200. Seen in 2026.9.6: Convex 512 MB out-of-memory