Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a straightforward OpenClaw upgrade guide, but it uses broad triggers and recommends persistent global package-manager changes that deserve review before installation.
Install only if you specifically want OpenClaw upgrade assistance for a GitHub-restricted environment. Before following the commands, confirm the exact OpenClaw version and registry source, avoid running package-manager installs as root, and be aware that changing the Yarn registry or restarting the gateway can affect future operations.
The skill recommends globally installing the mutable latest release of the openclaw package without pinning an audited version or verifying its integrity. Because the latest npm distribution tag can be changed by the package publisher or by an attacker who compromises the publisher or registry account, the package installed at execution time may differ from the version reviewed when this skill was created.
A global Yarn installation may also execute package lifecycle scripts, such as preinstall, install, or postinstall, under the privileges of the user running the command. The documentation does not require lockfile enforcement, checksum or signature verification, lifecycle-script suppression, or validation of the resolved package version and source.
This is a supply-chain exposure rather than evidence that the current openclaw package is malicious.
Attack Path
An attacker compromises the package publisher, registry account, or a dependency used by a future openclaw release.
The attacker publishes a malicious release and assigns it to the latest distribution tag.
A user follows the skill and runs yarn global add openclaw@latest.
Yarn resolves the attacker-controlled version and downloads its package and dependency graph.
Malicious lifecycle scripts may execute during installation, or malicious behavior may run when the globally installed openclaw command is invoked.
Impact Assessment
Successful exploitation could execute arbitrary code with the privileges of the user performing the installation. Potential effects include modification of user-accessible files, theft of credentials or configuration data, replacement of the globally instal
...[truncated 312 chars]
Remediation
View remediation
Remediation Suggestions
Replace openclaw@latest with an explicitly reviewed and pinned version, for example:
bash
yarn global add openclaw@2026.3.13
Confirm the package metadata and resolved version before installation:
bash
yarn info openclaw@2026.3.13 version dist
Verify published integrity data, provenance, signatures, or trusted release checksums where supported.
Test upgrades in an isolated container or non-privileged staging environment before deploying them to production.
Avoid running package-manager installation commands as root.
Consider initially disabling lifecycle scripts where operationally feasible:
bash
yarn global add openclaw@2026.3.13 --ignore-scripts
Required native build or setup steps should then be reviewed and performed explicitly.
Document a controlled upgrade process that reviews release notes, dependency changes, package ownership, and the exact registry source before changing the pinned version.
If a mirror is used, require a trusted mirror and verify that its package integrity metadata matches the authoritative registry.
The trigger phrases are broad enough to match generic requests like '更新系统' or '网络问题升级', which could invoke this skill outside its intended OpenClaw-specific context. That can cause the agent to apply package-management actions or upgrade guidance to unrelated situations, increasing the chance of incorrect or unsafe operational advice.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Low
Category
Not specified by scanner
Confidence
83% confidence
Finding
The skill documentation is written entirely in Chinese and does not indicate that the user can choose another language or locale. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
