T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/validate_openclaw_env.py:218- Finding
Malformed Environment Lines Can Disclose Credentials Through Validation Output
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Manager
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for OpenClaw operations, but its helper scripts can expose sensitive .env contents and allow misleading ledger entries.
Review this skill before installing in production workflows. It is not malicious, but users should avoid running the env validator where output is logged until malformed-line redaction is fixed, and should only pass trusted values to the ledger updater or store ledger records in a structured/sanitized format.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/update_openclaw_ops_ledger.py:43- Finding
Unescaped Ledger Fields Permit Persistent Markdown Content Injection
- Content
View full analysis
- Remediation
View remediation
str: if CONTROL_RE.search(value): raise ValueError(f"{name} contains prohibited control characters") return value ``` 2. Apply strict enumerations to fields with known values, including `mode`, `provider`, `os`, `environment`, and `secrets-profile`. 3. Validate `channels` and `integrations` against explicit allowlists rather than accepting arbitrary comma-separated strings. 4. Escape Markdown metacharacters if Markdown remains the canonical storage format. 5. Prefer writing canonical structured records, such as JSON Lines, with a separately generated Markdown view. Structured parsing prevents visual Markdown structure from becoming the security boundary. 6. Associate each entry with a unique run identifier and validate mandatory event ordering programmatically. 7. Where ledger integrity is security-critical, add authenticated integrity protection such as a signature or append-only storage with access controls. 8. Add tests that submit newline, heading, list-item, link, and HTML payloads in every free-form field and verify that they are rejected or safely encoded. ]]>
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description suggests a broad operational/deployment skill for OpenClaw, including secure deployment, runtime hardening, integration setup guidance, migration support, and incident response workflows. The supplied code chunk instead implements a narrow logging utility: it parses CLI flags, validates a date, ensures a ledger file exists, and appends a formatted markdown entry describing an event. This is materially different from the declared primary purpose. While ledgering could support operations workflows, this code does not itself provide deployment, hardening, troubleshooting, migration, or environment management functionality. Therefore the description does not accurately represent this code chunk’s actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a comprehensive OpenClaw deployment and operations skill covering installation, hosting across multiple providers, secure defaults, onboarding, troubleshooting, migration, tuning, and incident response. The supplied code does not implement those capabilities. Instead, it is a single validation script focused specifically on checking .env configuration files against profile-specific key requirements and simple secret-quality heuristics. While env validation and a small amount of configuration hardening support the broader deployment domain, the actual code chunk’s primary purpose is much narrower and materially different from the declared skill scope. This is therefore a description-behavior mismatch.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md "- [ ] Append `scope_lock` entry to ops ledger.", "", "## 2. Preflight Validation", f"- [ ] Validate `.env` with `scripts/validate_openclaw_env.py --env-file .env --profile {profile}`.", "- [ ] Block progression on any validation failure.", "- [ ] Append `predeploy_validation` entry to ops ledger.", "",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python "- [ ] Append `scope_lock` entry to ops ledger.", "", "## 2. Preflight Validation", f"- [ ] Validate `.env` with `scripts/validate_openclaw_env.py --env-file .env --profile {profile}`.", "- [ ] Block progression on any validation failure.", "- [ ] Append `predeploy_validation` entry to ops ledger.", "",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python "- [ ] Append `scope_lock` entry to ops ledger.", "", "## 2. Preflight Validation", f"- [ ] Validate `.env` with `scripts/validate_openclaw_env.py --env-file .env --profile {profile}`.", "- [ ] Block progression on any validation failure.", "- [ ] Append `predeploy_validation` entry to ops ledger.", "",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python "- [ ] Append `scope_lock` entry to ops ledger.", "", "## 2. Preflight Validation", f"- [ ] Validate `.env` with `scripts/validate_openclaw_env.py --env-file .env --profile {profile}`.", "- [ ] Block progression on any validation failure.", "- [ ] Append `predeploy_validation` entry to ops ledger.", "",
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs file-writing behavior via the operations ledger and references helper scripts that update local files, but it does not declare any explicit tool scope or allowed-tools boundaries. That omission weakens least-privilege controls and makes it easier for a consuming agent to perform unintended filesystem actions beyond what operators expect.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 55% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md | Infra ownership | Local machine/WSL resources | Cloud account + provider runtime | | Exposure defaults | Private-first | Provider ingress with explicit auth controls | | Required profile | `local` | `hosted-fly`, `hosted-render`, `hosted-railway`, `hosted-hetzner`, `hosted-gcp` | | Rollback model | Restore local config/state snapshot | Redeploy prior revision + restore persisted state | ## Decision Rules 1. If user wants minimal setup and no cloud account, prefer `local`.
Static analysis
No suspicious patterns detected.