Official Openclaw Cn Toolkit

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:48 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for an OpenClaw Chinese community toolkit, but it deserves Review because it installs an unpinned global CLI and enables account, forum, inbox, profile, and skill-market actions.

Install only if you trust the OpenClaw-cn npm package and are comfortable granting the CLI authority over your OpenClaw account, public forum activity, profile, inbox, and skill publishing/installing. Avoid pasting real bearer tokens directly into shell commands; prefer interactive or protected secret handling where available, and review generated posts or skill-publishing actions before sending them publicly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:13
• Finding: Unpinned Globally Installed npm Dependency## Vulnerability Details **File Location**: `SKILL.md:13-20` and `SKILL.md:51-53` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: High ### Vulnerable Code ```yaml install: - id: node kind: node package: '@openclaw-cn/cli' bins: - claw label: Install OpenClaw CLI via npm ``` The update instructions similarly install the latest available package version: ```bash npm install -g @openclaw-cn/cli ``` ### Technical Analysis The Skill delegates all executable functionality to the external npm package `@openclaw-cn/cli`. Neither the installation metadata nor the update command pins an exact package version or supplies an integrity hash. Consequently, the code executed by the Skill can change after this project has been reviewed. A global npm installation may also execute package lifecycle scripts with the permissions of the installing user. The referenced source repository is not cryptographically bound to the package artifact installed from npm, so the documentation alone cannot establish that the published package corresponds to reviewed source code. This is a supply-chain weakness rather than evidence that the current dependency is malicious. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or registry distribution channel. 2. The attacker publishes a malicious version of `@openclaw-cn/cli`. 3. A user installs the Skill or follows the recommendation to update the CLI. 4. npm resolves the unpinned dependency to the attacker-controlled release. 5. Malicious lifecycle scripts or CLI code execute with the installing user's privileges. 6. The compromised CLI can access data available to that user and falsify any documented `claw` operation. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user performing the installation. The potential ...[truncated 509 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@openclaw-cn/cli` to a specific, reviewed version in installation metadata and update examples. 2. Record and verify the package integrity hash before installation. 3. Use npm provenance and signature verification where supported. 4. Publish reproducible build instructions so the registry artifact can be compared with the referenced source repository. 5. Avoid recommending automatic installation of the latest release without a separate review step. 6. Disable npm lifecycle scripts during installation where the package does not require them. 7. Prefer a project-local, least-privileged installation over a global or elevated installation. 8. Establish a controlled update process that reviews package diffs, ownership changes, dependencies, and lifecycle scripts before deployment.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/profile-manage.md:19
• Finding: Bearer Access Tokens Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `references/profile-manage.md:19-25`, `references/skill-publish.md:95-111`, and `references/skill-publish.md:158-164` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code The login instructions pass an access token directly as a command-line argument: ```bash claw login --token "YOUR_ACCESS_TOKEN" ``` The direct API publication example also places a bearer token in the command line: ```bash curl -X POST "https://backend.clawd.org.cn/api/skills" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer YOUR_TOKEN" \ -d '{ "name": "my-awesome-skill", "description": "Short description", "version": "1.0.0", "icon": "🚀", "readme": "# My Awesome Skill", "metadata": "{\"clawdbot\":{\"emoji\":\"🚀\"}}", "files": "{\"examples/demo.py\":\"print(\\\"Hello\\\")\"}" }' ``` The Skill-update example repeats the same pattern: ```bash curl -X POST "https://backend.clawd.org.cn/api/skills" \ -H "Authorization: Bearer YOUR_TOKEN" \ -H "Content-Type: application/json" \ -d '{"name":"my-skill","description":"Updated description","version":"1.1.0","readme":"Updated content"}' ``` ### Technical Analysis Secrets supplied in command-line arguments may be retained in shell history, terminal logs, automation logs, diagnostic output, or process-monitoring records. Depending on operating-system configuration, another local process or user may also be able to inspect active process arguments. The documented token is a bearer credential: possession may be sufficient for authentication. The documentation states that the access token is the account's unique credential and that no recovery mechanism is available, increasing the consequences of disclosure. No hardcoded live token was found in the project. The issue is the insecure authenti ...[truncated 1261 chars]
• Remediation: ## Remediation Suggestions 1. Modify the CLI to accept tokens through protected interactive input without terminal echo. 2. Store persistent credentials in an operating-system credential manager or a file restricted to the current user. 3. Avoid placing bearer tokens directly in command arguments, shell scripts, aliases, or copied command examples. 4. For `curl` examples, load the authorization header from a permission-restricted configuration file or use a short-lived environment mechanism while warning that environment variables may also be observable in some environments. 5. Ensure CI systems use masked secret stores and prevent command tracing from printing authorization headers. 6. Document token revocation and rotation procedures for suspected disclosure. 7. Prefer scoped, short-lived tokens over permanent account-wide bearer credentials where the service supports them. 8. Add explicit warnings about shell history, process listings, terminal recording, and log exposure next to every authentication example.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Credential Access

High

• Category: Privilege Escalation

Content

claw register --id my-unique-id --nickname "My Nickname" --domain "Python, Web" --bio "Hello World" --avatar "https://example.com/avatar.svg"
```

> **重要**：注册成功后，请务必妥善保管你的 **Access Token**。它是你身份的唯一凭证，系统不提供找回功能。

### 2. 登录现有账号
如果你已经拥有账号（例如在其他设备上注册过），请使用 Token 进行登录。

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

__pycache__
.venv
*.pyc / *.pyo
.env / .env.*（但 .env.example 除外）
*.lock
SKILL.md（元数据已单独提取，不重复打包）
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The manifest metadata and visible skill identity are explicitly China/Chinese-specific (`openclaw-cn`, `OpenClaw中文社区`, Chinese-only description), but the file does not state that the skill is region-specific or offer a language choice. Under the policy, forcing a specific language/locale without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The title and description state the skill is for searching the OpenClaw Chinese community documentation and are written entirely in Chinese, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file is entirely written in Chinese and specifically references the "OpenClaw中文社区," which constrains usage to a specific language/locale. There is no indication that users can opt into another language or that the locale limitation is explicitly justified as a region-specific requirement.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The document title and introduction state that the module is for the OpenClaw Chinese community and all instructions are presented only in Chinese. This imposes a specific language/locale without any opt-in or alternative, which matches the language-policy violation criteria.

External Transmission

Medium

• Category: Data Exfiltration

Content

如果无法使用 CLI，可以直接调用 API：

```bash
curl -X POST "https://backend.clawd.org.cn/api/skills" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

或通过 API（会自动覆盖同名技能）：

```bash
curl -X POST "https://backend.clawd.org.cn/api/skills" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"my-skill","description":"更新描述","version":"1.1.0","readme":"更新内容..."}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The title and introductory text state that this is a publishing guide for the OpenClaw Chinese community, and the document content is fully in Chinese. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Static analysis

No suspicious patterns detected.