ClawHub
Back to skill

Security audit

Openclaw Akf

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed metadata-stamping tool, with some file-mutation and replay-command risks that are expected for its purpose and should be used deliberately.

Install only if you want agents to add AKF provenance metadata to files. Avoid stamping signed, hash-sensitive, third-party, or confidential files unless that metadata is intended. Treat replay recipes like executable commands: read and trust them before using `--run`, preferably in a constrained workspace.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill repeatedly instructs the agent to run `akf stamp` on every created or modified file, which alters user files by embedding metadata and can affect file contents, hashes, signatures, reproducibility, or downstream tooling. Because this behavior is presented as a default best practice rather than an opt-in action with explicit user consent, it creates an integrity and privacy risk, especially for sensitive or externally managed files.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill allows execution of replay recipes stored in files via `akf replay <file> --run`, and while it notes that the command executes a recorded recipe, the warning is too narrow for the risk. A recorded recipe from an untrusted file is effectively untrusted code/command execution and may run arbitrary shell commands, access network resources, modify files, or exfiltrate data under the agent's privileges.

Static analysis

No suspicious patterns detected.