OpenClaw Vulnerability Checker

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:14 PM UTC
• Version: 1.0.1

Overview

The skill is not plainly malicious, but it requests broad local inspection and optional credential use, then suggests configuration changes without tight user-control guardrails.

Review this skill before installing. Use it only when you expect an OpenClaw security audit to inspect local version, gateway, network, firewall, process, and tunnel state. Do not paste a GitHub personal access token into chat or shell history; use the least-privileged token possible and prefer unauthenticated public sources when adequate. Treat CVE examples in the local database as placeholders unless verified from GitHub, NVD, CNNVD, or official advisories. Require approval before any sudo, config.patch, tunnel shutdown, update, or gateway restart command is run.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/get_releases.py:10

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

--hash=sha256: ``` 4. Install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 5. Use an isolated virtual environment and avoid `sudo pip`. 6. Configure an explicitly trusted package index and review transitive dependencies. 7. Add automated dependency vulnerability and provenance checks to release validation. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:403

Finding

Overbroad Host Process and Tunnel Configuration Reconnaissance

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: references/vulnerabilities.md:22

Finding

Placeholder Vulnerability Records May Be Reported as Genuine Findings

Content

View full analysis

= 2026.1.0, < 2026.3.0 | 2026.3.0 | ``` ### Technical Analysis `SKILL.md` identifies `references/vulnerabilities.md` as the local vulnerability database and directs the Agent to use it as a fallback data source. However, this file contains only template and example records. The records resemble real vulnerability data and include plausible version ranges, CVSS scores, impact types, and remediation versions. The Markdown document explains that the content is a template, but it provides no machine-readable mechanism that prevents an Agent or future parser from treating the examples as active records. In particular, the example range `< 2026.3.10` could match a real installed version. This is an integrity and validation flaw rather than direct code execution. It can generate false security conclusions when authoritative remote sources are unavailable or when an Agent insufficiently distinguishes example content from verified data. ### Attack Path 1. GitHub, NVD, or CNNVD data is una ...[truncated 1247 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

声明描述的核心能力是“安全漏洞检查与配置审计”，但代码实际功能只是版本发布信息抓取与版本差异展示。虽然“对比当前版本与最新版本的差异”“获取最新版本更新”与代码部分吻合，但这只是声明中的次要一部分。代码没有检查 CVE、没有扫描配置、没有判断是否开启公网访问，也没有进行任何安全风险评估。因此其主要目的与声明明显不一致，属于实质性描述-行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose centers on security analysis and audit functions, but the code chunk’s actual primary purpose is version retrieval. While the helper functions compare_versions and is_version_affected could support future vulnerability checks, no vulnerability database, latest-version source, configuration inspection, or public-access detection appears in this code. Therefore the implemented behavior is only a small supporting subset of the declared tool and does not substantiate the claimed security auditing capabilities.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The skill explicitly asks for a GitHub Personal Access Token with repo permissions to retrieve advisory data. Requesting high-value credentials in a skill materially increases the risk of credential mishandling, overcollection, or accidental disclosure, especially when the same file also shows command-line token usage.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

1. **GitHub Security Advisories**（如果用户提供了 GitHub token）
   - 使用 GitHub API 查询：`https://api.github.com/repos/openclaw/openclaw/security/advisories`
   - 优点：官方、结构化、包含修复版本信息
   - 需要：GitHub Personal Access Token（有 repo 权限）

2. **CNNVD（中国国家信息安全漏洞库）**
   - 通过 web_fetch 搜索相关页面

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill clearly instructs the agent to use shell commands and external network access, but it declares no tool scope or permissions. This creates an authorization gap where a caller or platform may not realize the skill can inspect the local system and transmit data to third-party services, increasing the chance of unsafe execution or overprivileged use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is configured to auto-trigger on broad user interest in OpenClaw security risk, which can cause unsolicited execution of shell and network inspection steps in situations where the user did not specifically request system scanning. In a security-checking skill, overbroad activation is more dangerous because the actions may enumerate local configuration, running processes, and network exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The skill instructs outbound requests to GitHub for advisory data, potentially including repository context and authenticated tokens. External transmission is sensitive in a host-inspection skill because results derived from the local environment may be sent off-box, and users may not expect that when asking for a local security audit.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

**优先级顺序：**

1. **GitHub Security Advisories**（如果用户提供了 GitHub token）
   - 使用 GitHub API 查询：`https://api.github.com/repos/openclaw/openclaw/security/advisories`
   - 优点：官方、结构化、包含修复版本信息
   - 需要：GitHub Personal Access Token（有 repo 权限）

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill recommends configuration-changing commands and service restart actions as direct remediation without a strong warning, confirmation gate, rollback guidance, or environment checks. This can lead an agent to modify live security settings or restart services in production, causing outages, lockouts, or unintended exposure changes.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The example curl command embeds use of a GitHub personal access token in a shell invocation. In practice this can expose credentials through shell history, process listings, logs, or copied transcripts, making token compromise more likely.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

bash

# 使用 curl + GitHub Token
curl -H "Authorization: token YOUR_GITHUB_TOKEN" \
  https://api.github.com/repos/openclaw/openclaw/security/advisories

响应格式示例：

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 406)May include surrounding context.

ps aux | grep -E "tailscale|ngrok|frp|cloudflared"

检查 Tunnels 配置目录

ls -la ~/.config/ngrok/ ls -la ~/.local/share/tailscale/

text

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 407)May include surrounding context.

ps aux | grep -E "tailscale|ngrok|frp|cloudflared"

检查 Tunnels 配置目录

ls -la ~/.config/ngrok/ ls -la ~/.local/share/tailscale/

text

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The docstring and argument parser description state that the script gets release/update information for 'OpenClow', which is a different product name from the manifest's stated 'OpenClaw'. The actual network request targets the 'openclaw/openclaw' GitHub repository, so the embedded documentation is internally inconsistent about what software is being analyzed.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/vulnerabilities.md (reported line 101)May include surrounding context.

md

Returns:
        list: releases 列表
    """
    url = "https://api.github.com/repos/openclaw/openclaw/releases"
    try:
        headers = {
            'Accept': 'application/vnd.github.v3+json',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get_releases.py (reported line 32)May include surrounding context.

python

Returns:
        list: releases 列表
    """
    url = "https://api.github.com/repos/openclaw/openclaw/releases"
    try:
        headers = {
            'Accept': 'application/vnd.github.v3+json',

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/get_version.py (reported line 27)May include surrounding context.

python

dict: 包含 version, commit, full 信息
    """
    try:
        result = subprocess.run(
            ['openclaw', '--version'],
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language instructions and output text exclusively in Chinese, including the module docstring and CLI help. That can violate language/locale policy when users are not given a choice of language or informed that the tool is Chinese-only.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The top-level docstring and function docstring state they retrieve "OpenClow" version information, but the implementation executes openclaw --version and expects output beginning with OpenClaw. This is a documentation-to-code contradiction rather than a mere omission, because it names a different product than the one the code targets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

SQP-3 applies to all file types and covers language/locale policy violations in natural-language content. The module docstring and usage/output text force a specific language for user-facing instructions, while the file provides no opt-in, alternative language, or justification that this is a region-specific tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.