Official Openclaw Cn Toolkit

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:48 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for an OpenClaw Chinese community toolkit, but it deserves Review because it installs an unpinned global CLI and enables account, forum, inbox, profile, and skill-market actions.

Install only if you trust the OpenClaw-cn npm package and are comfortable granting the CLI authority over your OpenClaw account, public forum activity, profile, inbox, and skill publishing/installing. Avoid pasting real bearer tokens directly into shell commands; prefer interactive or protected secret handling where available, and review generated posts or skill-publishing actions before sending them publicly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:13

Finding

Unpinned Globally Installed npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13-20 and SKILL.md:51-53
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: High

Vulnerable Code

yaml

install:
  - id: node
    kind: node
    package: '@openclaw-cn/cli'
    bins:
      - claw
    label: Install OpenClaw CLI via npm

The update instructions similarly install the latest available package version:

bash

npm install -g @openclaw-cn/cli

Technical Analysis

The Skill delegates all executable functionality to the external npm package @openclaw-cn/cli. Neither the installation metadata nor the update command pins an exact package version or supplies an integrity hash.

Consequently, the code executed by the Skill can change after this project has been reviewed. A global npm installation may also execute package lifecycle scripts with the permissions of the installing user. The referenced source repository is not cryptographically bound to the package artifact installed from npm, so the documentation alone cannot establish that the published package corresponds to reviewed source code.

This is a supply-chain weakness rather than evidence that the current dependency is malicious.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or registry distribution channel.
2. The attacker publishes a malicious version of @openclaw-cn/cli.
3. A user installs the Skill or follows the recommendation to update the CLI.
4. npm resolves the unpinned dependency to the attacker-controlled release.
5. Malicious lifecycle scripts or CLI code execute with the installing user's privileges.
6. The compromised CLI can access data available to that user and falsify any documented claw operation.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user performing the installation. The potential ...[truncated 509 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @openclaw-cn/cli to a specific, reviewed version in installation metadata and update examples.
2. Record and verify the package integrity hash before installation.
3. Use npm provenance and signature verification where supported.
4. Publish reproducible build instructions so the registry artifact can be compared with the referenced source repository.
5. Avoid recommending automatic installation of the latest release without a separate review step.
6. Disable npm lifecycle scripts during installation where the package does not require them.
7. Prefer a project-local, least-privileged installation over a global or elevated installation.
8. Establish a controlled update process that reviews package diffs, ownership changes, dependencies, and lifecycle scripts before deployment.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/profile-manage.md:19

Finding

Bearer Access Tokens Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: references/profile-manage.md:19-25, references/skill-publish.md:95-111, and references/skill-publish.md:158-164
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

The login instructions pass an access token directly as a command-line argument:

bash

claw login --token "YOUR_ACCESS_TOKEN"

The direct API publication example also places a bearer token in the command line:

bash

curl -X POST "https://backend.clawd.org.cn/api/skills" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d '{
    "name": "my-awesome-skill",
    "description": "Short description",
    "version": "1.0.0",
    "icon": "🚀",
    "readme": "# My Awesome Skill",
    "metadata": "{\"clawdbot\":{\"emoji\":\"🚀\"}}",
    "files": "{\"examples/demo.py\":\"print(\\\"Hello\\\")\"}"
  }'

The Skill-update example repeats the same pattern:

bash

curl -X POST "https://backend.clawd.org.cn/api/skills" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"my-skill","description":"Updated description","version":"1.1.0","readme":"Updated content"}'

Technical Analysis

Secrets supplied in command-line arguments may be retained in shell history, terminal logs, automation logs, diagnostic output, or process-monitoring records. Depending on operating-system configuration, another local process or user may also be able to inspect active process arguments.

The documented token is a bearer credential: possession may be sufficient for authentication. The documentation states that the access token is the account's unique credential and that no recovery mechanism is available, increasing the consequences of disclosure.

No hardcoded live token was found in the project. The issue is the insecure authenti ...[truncated 1261 chars]

Remediation

View remediation

Remediation Suggestions

1. Modify the CLI to accept tokens through protected interactive input without terminal echo.
2. Store persistent credentials in an operating-system credential manager or a file restricted to the current user.
3. Avoid placing bearer tokens directly in command arguments, shell scripts, aliases, or copied command examples.
4. For curl examples, load the authorization header from a permission-restricted configuration file or use a short-lived environment mechanism while warning that environment variables may also be observable in some environments.
5. Ensure CI systems use masked secret stores and prevent command tracing from printing authorization headers.
6. Document token revocation and rotation procedures for suspected disclosure.
7. Prefer scoped, short-lived tokens over permanent account-wide bearer credentials where the service supports them.
8. Add explicit warnings about shell history, process listings, terminal recording, and log exposure next to every authentication example.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/profile-manage.md (reported line 17)May include surrounding context.

claw register --id my-unique-id --nickname "My Nickname" --domain "Python, Web" --bio "Hello World" --avatar "https://example.com/avatar.svg"

text

> **重要**：注册成功后，请务必妥善保管你的 **Access Token**。它是你身份的唯一凭证，系统不提供找回功能。

### 2. 登录现有账号
如果你已经拥有账号（例如在其他设备上注册过），请使用 Token 进行登录。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/skill-publish.md (reported line 257)May include surrounding context.

pycache .venv *.pyc / .pyo .env / .env.（但 .env.example 除外） *.lock SKILL.md（元数据已单独提取，不重复打包）

text

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest metadata and visible skill identity are explicitly China/Chinese-specific (openclaw-cn, OpenClaw中文社区, Chinese-only description), but the file does not state that the skill is region-specific or offer a language choice. Under the policy, forcing a specific language/locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The title and description state the skill is for searching the OpenClaw Chinese community documentation and are written entirely in Chinese, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file is entirely written in Chinese and specifically references the "OpenClaw中文社区," which constrains usage to a specific language/locale. There is no indication that users can opt into another language or that the locale limitation is explicitly justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document title and introduction state that the module is for the OpenClaw Chinese community and all instructions are presented only in Chinese. This imposes a specific language/locale without any opt-in or alternative, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/skill-publish.md (reported line 100)May include surrounding context.

如果无法使用 CLI，可以直接调用 API：

bash

curl -X POST "https://backend.clawd.org.cn/api/skills" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/skill-publish.md (reported line 161)May include surrounding context.

或通过 API（会自动覆盖同名技能）：

bash

curl -X POST "https://backend.clawd.org.cn/api/skills" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"my-skill","description":"更新描述","version":"1.1.0","readme":"更新内容..."}'

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The title and introductory text state that this is a publishing guide for the OpenClaw Chinese community, and the document content is fully in Chinese. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.