OpenClaw Security Audit — BLUF Report

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:50 AM UTC
• Version: 1.0.1

Overview

The skill performs a plausible OpenClaw audit workflow, but its safety claims conflict with instructions that persist reports, read Telegram environment credentials, send audit contents externally, and create a recurring scheduled job.

Review before installing. Use stdout-only unless you explicitly want persistent records or Telegram delivery, and do not enable the cron example without confirming the schedule, destination, retention, redaction, and removal process. The audit function itself is coherent, but the current skill text under-discloses where sensitive report data can go.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:143
• Finding: Persistent Scheduled Audit and External Report Delivery## Vulnerability Details **File Location**: `SKILL.md`, lines 143–147 **Vulnerability Type**: Persistent scheduled task **Risk Level**: High ### Complete Code Snippet ```text ## Scheduling (cron) To run this audit automatically (e.g. daily at 04:00): ``` openclaw cron add --name "security-audit:daily" --cron "0 4 * * *" --prompt "Run the eva-security-audit skill and send the report to memory and Telegram." ``` ``` ### Technical Analysis The instruction creates an OpenClaw cron task that survives the current Skill invocation and executes every day. It also directs future executions to send reports to persistent memory and Telegram. Persistent scheduling is not required for the declared core function of producing a one-time security snapshot. Although the command appears as documented guidance rather than code that executes automatically, an agent following the Skill may install it without obtaining separate, informed approval for persistence and recurring external delivery. This exceeds the minimum privileges required for an on-demand audit. ### Attack Path 1. A user or automation invokes the Skill for a security audit. 2. The agent follows the scheduling guidance and executes the supplied `openclaw cron add` command. 3. A persistent daily job is registered. 4. The job repeatedly invokes the Skill in later sessions. 5. Each scheduled run can write the report to memory and transmit it through Telegram without fresh authorization. 6. Sensitive deployment findings continue to leave the immediate audit context until the job is discovered and removed. ### Impact Assessment The resulting task obtains recurring execution through the OpenClaw scheduler and persists beyond the original run. Its scope includes repeated local audit execution, modification of persistent memory, and recurring disclosure of security reports to an external messaging destination. The persistence does not itself demonstrate operating-system ...[truncated 109 chars]
• Remediation: ## Remediation Suggestions - Remove the cron-installation command from the default workflow. - Keep one-time execution and stdout-only reporting as the default behavior. - If scheduling is requested, require explicit user confirmation immediately before creating the job. - Display the schedule, execution identity, delivery destinations, retention behavior, and exact removal command before installation. - Separate scheduling from external delivery so consent to one does not imply consent to the other. - Provide a command to inspect and remove the created task, and verify successful removal. - Require fresh authorization before enabling Telegram delivery for scheduled executions.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:112
• Finding: Sensitive Security Report Sent to Telegram Using Environment Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 112–119 **Vulnerability Type**: Excessive credential and network access **Risk Level**: High ### Complete Code Snippet ```python **Telegram (if BOT_TOKEN and CHAT_ID are in environment):** ```python import os, requests requests.post( f"https://api.telegram.org/bot{os.getenv('TELEGRAM_BOT_TOKEN')}/sendMessage", json={"chat_id": os.getenv('MASTER_TELEGRAM_ID'), "text": report} ) ``` ``` ### Technical Analysis The delivery example reads `TELEGRAM_BOT_TOKEN` and `MASTER_TELEGRAM_ID` from the process environment and submits the complete audit report to Telegram. Security-audit output may contain sensitive details about authentication weaknesses, filesystem permissions, exposed services, sandbox configuration, and persistence mechanisms. This behavior directly contradicts the trust statements at `SKILL.md:19–21`, which claim that the Skill performs no network calls, never reads credentials or environment variables, and does not exfiltrate data. Consequently, a user relying on those assurances may authorize the Skill without understanding its actual access and disclosure behavior. The bot token is also placed in the request URL. URLs can be captured by application diagnostics, proxy logs, exception output, or monitoring infrastructure, increasing the token's exposure surface. ### Attack Path 1. The Skill runs `openclaw security audit --deep` and captures deployment findings. 2. Telegram credentials and a destination identifier are available in the agent's environment. 3. The agent follows the delivery instructions and reads those environment variables. 4. The complete report is submitted to the Telegram Bot API. 5. Anyone controlling or accessing the configured Telegram chat receives the deployment's security findings. 6. If the request URL is logged, the bot token may also become available to log readers, potentially enabling unauthorized use ...[truncated 548 chars]
• Remediation: ## Remediation Suggestions - Remove Telegram delivery from the default workflow and default to stdout. - Require explicit, per-run authorization before transmitting any report. - Display and confirm the destination without revealing the token. - Redact secrets, host identifiers, vulnerable endpoints, and other sensitive details before transmission. - Use a vetted messaging integration with restricted credential access rather than directly reading arbitrary process environment variables. - Scope the bot to the minimum permissions and rotate any token that may have appeared in logs. - Prevent request URLs and authorization data from being recorded in logs or error reports. - Add timeouts and explicit error handling to the network request. - Correct the claims at lines 19–21 so the documentation accurately discloses network, environment-variable, and data-transmission behavior.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:106
• Finding: Generated Audit Output Interpolated into a Shell Command## Vulnerability Details **File Location**: `SKILL.md`, lines 106–110 **Vulnerability Type**: Shell command injection and unauthorized file modification **Risk Level**: High ### Complete Code Snippet ```bash **Memory (default for scheduled runs):** ```bash # Append to today's memory file echo "[audit result]" >> memory/$(date +%Y-%m-%d).md ``` ``` ### Technical Analysis The instruction expects generated audit output to replace the `[audit result]` placeholder inside a double-quoted shell command. If an agent constructs the final command by inserting report text before shell parsing, shell syntax within the report—such as command substitutions using `$()` or backticks—can be evaluated by the shell. Audit output should not be assumed to be trusted data. It may include names, identifiers, paths, configuration values, or diagnostic text influenced by locally installed components. Interpolating such content into executable shell syntax creates a data-to-command boundary violation. The command also appends data to persistent agent memory, contradicting the claim at `SKILL.md:18` that the Skill is read-only and does not write files. ### Attack Path 1. An attacker causes a value inspected by the audit to contain shell metacharacters or command-substitution syntax. 2. The audit includes that value in a generated finding or report. 3. The agent replaces `[audit result]` with the report text in the documented command. 4. The shell parses the resulting command. 5. Embedded command substitutions execute with the privileges of the agent process. 6. The attacker can perform actions allowed to that account, while the report is also appended to persistent memory. Exploitability depends on the agent performing textual interpolation into the shell command before execution. Passing the report through a properly quoted variable or a non-shell file API would not recursively evaluate shell syntax. ### Impact Assessment ...[truncated 431 chars]
• Remediation: ## Remediation Suggestions - Never insert generated report text directly into a shell command. - Write the report using a filesystem API that treats the entire report as data. - If a shell is unavoidable, pass the content through standard input to a fixed command rather than constructing executable command text. - Use a fixed, validated destination path and prevent path traversal or symlink-based redirection. - Obtain explicit approval before modifying persistent memory. - Store audit records separately from files that influence future agent instructions or behavior. - Correct the read-only claim at line 18 or remove all file-writing workflows. - Add tests using report content containing `$()`, backticks, quotes, newlines, redirection operators, and other shell metacharacters.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

• Category: YARA Match

Content

not add commentary, context, or suggestions beyond what the audit output contains.

### 5. Deliver the report

Choose one or more delivery targets based on user context:

**Memory (default for scheduled runs):**
```bash
# Append to today's memory file
echo "[audit result]" >> memory/$(date +%Y-%m-%d).md
```

**Telegram (if BOT_TOKEN and CHAT_ID are in environment):**
```python
import os, requests
requests.post(
    f"https://api.telegram.org/bot{os.getenv('TELEGRAM_BOT_TOKEN')}/sendMessage",
    json={"chat_id": os.getenv('MASTER_TELEGRAM_ID'), "text": report}
)
```

**Stdout only:** print the report and exit.

---

## Quick-fix reference

These are the most common findings and their fixes. Apply and re-run to confirm:

| Finding ID | Fix |
|------------|-----|
| `fs.config.perms_writable` | `chmod 600 ~/.openclaw/openclaw.json` |
| `skills.code_safety` | Review flagged skill source — remove if untrusted |
| `gateway.nodes.deny_commands_ineffective` | Update `denyCommands` to use exa

• Confidence: 93% confidence
• Finding: The combination of reading environment-based Telegram credentials and sending report data to an external endpoint matches a credential-plus-exfiltration pattern. Although the apparent purpose is reporting rather than overt credential theft, the pattern is still dangerous because it normalizes secret access and outbound transmission in a skill that claims the opposite.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill explicitly claims there are no network calls or data exfiltration, yet later includes Telegram delivery over HTTPS. This is dangerous because operators may trust the safety claims and permit execution in sensitive environments, resulting in audit contents being transmitted off-host without informed consent.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill claims it never reads credentials, tokens, or environment variables, but the Telegram example directly accesses TELEGRAM_BOT_TOKEN and MASTER_TELEGRAM_ID via os.getenv(). Misrepresenting credential access undermines security review and could cause the skill to be used where secrets exposure policies would otherwise forbid it.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The description says to use the skill whenever a user needs a 'fast, automated security snapshot' including broad contexts like 'on a schedule, after a config change, before an engagement, or during an agent briefing.' This is a markdown file, so vague-trigger review applies, and the activation guidance does not define explicit trigger phrases, exclusions, or clear limits on when this skill should or should not be invoked.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The skill is labeled read-only and as not writing files, but it later instructs appending results to memory/YYYY-MM-DD.md. This discrepancy can lead users to run the skill in environments where file writes are prohibited or where audit output persistence creates unintended data retention.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The workflow includes persisting audit results to memory files and optionally sending them to Telegram, but it does not prominently warn that findings may be stored locally or leave the machine. Security audit output can contain sensitive configuration details, making silent persistence or transmission risky in production environments.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
import os, requests
requests.post(
    f"https://api.telegram.org/bot{os.getenv('TELEGRAM_BOT_TOKEN')}/sendMessage",
    json={"chat_id": os.getenv('MASTER_TELEGRAM_ID'), "text": report}
)
```

• Confidence: 90% confidence
• Finding: This code posts the audit report to the Telegram API, creating an external transmission channel. In the context of a security-audit skill, report contents may include sensitive host, configuration, or control-plane information that should not be sent off-device without strict approval.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

| Finding ID | Fix |
|------------|-----|
| `fs.config.perms_writable` | `chmod 600 ~/.openclaw/openclaw.json` |
| `skills.code_safety` | Review flagged skill source — remove if untrusted |
| `gateway.nodes.deny_commands_ineffective` | Update `denyCommands` to use exact node command IDs (e.g. `canvas.present` not `canvas`) |
| `gateway.sandbox_disabled` | Set `sandbox.mode` to `"on"` in openclaw.json for untrusted skill execution |

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.