Security audit

openclaw-agentlog

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real AgentLog tracing skill, but it captures sensitive agent activity by default and can modify the OpenClaw runtime during installation.

Install only if you intentionally want comprehensive AgentLog observability and trust the configured backend. Assume prompts, reasoning snippets, tool arguments, tool outputs, file paths, command results, and session metadata may be stored. Avoid installing on production OpenClaw gateways until you have reviewed or disabled the postinstall/dist patching behavior, confirmed the remote target and rollback path, and decided whether reasoning/tool capture should be turned off or redacted.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises and implies access to environment variables, files, network services, and shell-level operations, but does not declare permissions or boundaries. That creates a trust and review gap: operators may enable the skill without understanding that it can read/write local state, call backend services, and potentially execute system actions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This is a serious description-behavior mismatch. The skill presents itself as a logging and trace-management component, but the reported behavior includes remote deployment, hot-patching installed JavaScript bundles, modifying local installation files during postinstall, controlling a systemd service, and rollback logic—capabilities far beyond passive logging. Such hidden operational and code-modification behavior can enable persistence, unauthorized system changes, and supply-chain style compromise.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The script has broad remote host management capability over SSH, rsync, systemctl, and destructive rollback of the dist directory, which gives it much more power than a logging/trace skill would imply. In the context of an agent skill, this is dangerous because installing the skill effectively grants remote code deployment and service-control ability on the target host, increasing the blast radius if the skill or distribution path is compromised.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The script actively modifies JavaScript files inside a globally installed OpenClaw dist bundle under the user's npm-global directory. Even if intended for customization, this is a supply-chain-style local code patch that changes behavior outside normal skill boundaries and can persistently alter the host agent runtime, which is riskier than ordinary trace logging.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The header claims the script is retained 'for reference only' and 'will NOT work on v4.5+', but the program still performs real filesystem writes if executed. That mismatch can mislead operators into running a script they believe is inert, resulting in unintended modification of installed application bundles and difficult-to-debug behavior.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This postinstall script searches for the host's OpenClaw installation and directly rewrites files in another installed package's dist directory. That is dangerous because installation of this skill causes undeclared, non-local code modification outside its own package boundary, creating a supply-chain style integrity risk and making the host runtime execute altered code without explicit operator approval.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The main install flow automatically enumerates OpenClaw dist files, backs them up, and patches matching JavaScript at install time. In the context of a logging/trace-management skill, this materially expands privilege and persistence because simply installing the package mutates the agent platform itself, which can break updates, hide behavior changes, or be repurposed for arbitrary code injection if the patch pattern or replacement changes.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The activation condition is broad enough that the skill may auto-activate for essentially all OpenClaw Agent evidence needs and handoff scenarios. For a skill with logging, backend communication, and potentially broader system capabilities, overbroad activation increases the chance of unintended data capture or execution in contexts where the user did not expect it.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The skill explicitly states that it captures reasoning, tool calls, responses, and logs them to a backend, but it does not provide a clear warning about privacy, sensitive data handling, or data transmission. Because reasoning and tool inputs/outputs may contain secrets, credentials, proprietary code, or personal data, silent automatic capture materially increases confidentiality risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The rollback path performs a remote 'rm -rf' of the active dist directory and replaces it with a backup without any interactive confirmation, dry-run mode, or explicit warning at execution time. This is dangerous because a mistaken invocation, wrong remote host, or path misconfiguration can immediately break the remote service or destroy the active installation state.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The plugin registers for multiple high-privilege lifecycle hooks, including tool-call and LLM-output events, without any scoping or activation constraints in the manifest. In this skill’s context, that means it can automatically observe and persist broad agent activity, including potentially sensitive prompts, reasoning, tool inputs/outputs, and session metadata across all OpenClaw agent runs.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The manifest enables broad lifecycle hooks including agent start, tool calls, LLM output, and session end, but the package metadata does not define any trigger scope, limiting conditions, or activation constraints. In a logging skill, this increases the chance of collecting sensitive prompts, reasoning traces, tool arguments, and outputs across all sessions by default, creating an overbroad data-capture surface if the skill is installed widely.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script executes automatically during installation and modifies files immediately, without an interactive prompt or prior consent at the point of execution. This is risky because users and CI systems often treat package installation as passive dependency retrieval, so silent mutation of system-wide package files undermines trust, auditability, and change control.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The plugin sends trace/span payloads to backend APIs containing content, tool details, and later reasoning summaries without any consent flow, redaction, or minimization. In an agent context, tool inputs/outputs commonly contain secrets, proprietary code, tokens, file paths, or sensitive prompts, so silent exfiltration to a backend materially increases confidentiality risk.

Ssd 3

High

Confidence: 98% confidence
Finding: The default configuration enables reasoningCapture and toolCallCapture, meaning the plugin is designed to collect highly sensitive internal model reasoning and complete tool interactions by default. In agent environments, these fields can include secrets, authentication material, source code, user data, and operational context, making remote logging of them a serious privacy and data-exposure risk.

Ssd 3

High

Confidence: 99% confidence
Finding: The reasoning extraction logic explicitly harvests assistant 'thinking'/'reasoning' blocks and stores them for later transmission in finalizeTrace. Capturing and exporting internal reasoning is especially dangerous because it may contain hidden prompts, policy context, secrets surfaced during deliberation, or other sensitive intermediate data not intended for retention or sharing.

Ssd 3

High

Confidence: 98% confidence
Finding: afterToolCall serializes full tool arguments and results into span content and sends them to the backend. Tool payloads often contain file contents, command outputs, access tokens, API responses, credentials, or personal data, so transmitting them wholesale creates a direct exfiltration channel.

Unpinned Dependencies

Low

Category: Supply Chain
Content: } }, "dependencies": { "nanoid": "^5.1.7" }, "devDependencies": { "@types/node": "^20.0.0",
Confidence: 88% confidence
Finding: The runtime dependency uses a caret range, allowing installation of newer semver-compatible versions that were not necessarily reviewed with this skill. Because this package installs a postinstall script and registers broad hooks for logging agent activity, any unexpected dependency change in the supply chain could affect a component running in a sensitive context.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/index.ts:169

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/index.ts:29

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: src/index.ts:181