Setup

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:22 PM UTC
• Version: 1.0.0

Overview

This is a documentation-only setup skill, but it recommends several high-impact configurations without enough local containment or privacy warnings.

Review this skill before installing and do not apply the broad example profiles as defaults. Prefer minimal or coding-specific tool profiles, sandbox exec, avoid exec.security full, keep personal Chrome relay off unless explicitly needed, use local memory search for sensitive work, exclude session transcripts and email bodies unless there is a clear need, and protect ~/.openclaw/.env with restrictive permissions or a proper secret store.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: recommendations.md:20

Finding

Recommended configurations grant unrestricted host command execution

Content

View full analysis

Vulnerability Details

File Location: recommendations.md:20-23 and recommendations.md:78-84
Vulnerability Type: Least-privilege violation through unrestricted tool and command access
Risk Level: High

Vulnerable Configuration

Personal Assistant configuration:

json

"tools": {
  "profile": "full",
  "exec": { "security": "full" }
}

Developer Workstation configuration:

json

"tools": {
  "profile": "full",
  "exec": {
    "security": "full",
    "safeBins": ["git", "npm", "pnpm", "node", "python", "docker"]
  }
}

Technical Analysis

Both configurations recommend the full tool profile together with exec.security set to full. If adopted, this permits the agent to invoke arbitrary host commands rather than only the operations necessary to configure OpenClaw.

The safeBins list in the Developer Workstation configuration does not impose a security boundary while execution security is set to full. The agent therefore retains unrestricted command access regardless of that list.

This is especially dangerous when the agent receives content from messaging channels, websites, repositories, workspace instruction files, or other sources that may contain prompt injection. Sender allowlisting reduces exposure but does not eliminate malicious content, compromised owner accounts, unsafe repository content, or model-generated mistakes.

Attack Path

1. A user applies one of the documented configurations.
2. OpenClaw grants the agent the full tool profile and unrestricted host execution.
3. The agent processes an attacker-controlled message, webpage, repository file, or workspace instruction.
4. The content induces the agent to invoke the execution tool.
5. The agent runs attacker-selected commands directly on the host.
6. Those commands can read or modify files, launch processes, install software, access credentials available to the user, or operate Docker.

...[truncated 455 chars]

Remediation

View remediation

Remediation Suggestions

• Replace profile: "full" with minimal or a narrowly tailored profile.
• Set exec.security to allowlist or deny by default.
• Run execution inside a sandbox rather than on the gateway host.
• Use read-only workspace access unless modification is explicitly required.
• Require explicit user confirmation for commands that modify files, install packages, access credentials, control containers, or communicate externally.
• Restrict execution to narrowly scoped wrapper commands with validated arguments.
• Do not describe unrestricted execution as a normal default, even for a single-user deployment.
• Document that sender allowlisting is not a substitute for execution isolation.

T09 · Insecure Skill Coding Practices

Error

• Location: tools.md:133

Finding

Executable allowlist includes general-purpose interpreters and package tooling

Content

View full analysis

Vulnerability Details

File Location: tools.md:133-143
Vulnerability Type: Ineffective command allowlist enabling arbitrary code execution
Risk Level: High

Vulnerable Configuration

json

{
  "tools": {
    "exec": {
      "host": "gateway",
      "security": "allowlist",
      "safeBins": [
        "cat", "ls", "head", "tail", "grep",
        "git", "npm", "node", "python"
      ],
      "timeoutSec": 300,
      "backgroundMs": 10000,
      "pathPrepend": ["/usr/local/bin"]
    }
  }
}

Technical Analysis

The apparent execution boundary is ineffective because the allowlist contains node and python, which are general-purpose interpreters capable of reading and writing files, spawning subprocesses, opening network connections, and executing arbitrary inline or file-based code.

The list also includes npm, which can run package lifecycle scripts, and git, which has configuration-sensitive behavior involving hooks, aliases, external helpers, pagers, and related subprocesses. Consequently, restricting execution by executable name alone does not provide meaningful containment when such powerful programs are allowed.

The commands execute on the gateway host rather than in a sandbox, increasing the scope of compromise.

Attack Path

1. A user applies the documented allowlist configuration.
2. An attacker-controlled prompt or document instructs the agent to perform an operation using an allowed executable.
3. The agent invokes python or node with inline code or a generated script.
4. The interpreter performs unrestricted filesystem, process, or network operations under the gateway account.
5. Alternatively, the agent invokes npm against a package containing lifecycle scripts or uses execution-capable Git behavior.
6. The allowlist check succeeds because the initial executable name is permitted.

Impact Assessment

Exploitation can provide arbitrar ...[truncated 309 chars]

Remediation

View remediation

Remediation Suggestions

• Remove python, node, npm, and similarly general-purpose runtimes or package managers from safeBins.
• Review whether git is necessary; if so, expose only narrowly scoped Git operations through a validated wrapper.
• Validate command arguments, paths, environment variables, and working directories rather than checking only the executable name.
• Run all development tooling in a disposable sandbox with restricted filesystem and network access.
• Disable package lifecycle scripts where package installation is unavoidable.
• Apply execution time, process, memory, and output limits.
• Use separate task-specific wrappers such as read-only repository inspection rather than exposing complete executables.

other

Warning

• Location: memory.md:8

Finding

Remote memory indexing can transmit session transcripts to an external provider

Content

View full analysis

Vulnerability Details

File Location: memory.md:8-14, with equivalent guidance at agents.md:123-128
Vulnerability Type: External processing of potentially sensitive conversation history
Risk Level: Medium

Vulnerable Configuration

json

{
  "agents": {
    "defaults": {
      "memorySearch": {
        "enabled": true,
        "provider": "openai",
        "sources": ["memory", "sessions"],
        "model": "text-embedding-3-small"
      }
    }
  }
}

Technical Analysis

The configuration enables memory search through a remote provider and includes past session transcripts as an indexing source. Creating remote embeddings requires session content to be processed by the selected external service.

Session transcripts can contain personal information, proprietary source code, internal operational details, or credentials accidentally supplied during conversations. The documentation does not accompany this configuration with a clear transmission warning, informed opt-in requirement, secret filtering, data classification guidance, or retention-policy discussion.

This behavior may be required when a user explicitly chooses remote semantic search, but including complete session history is not the minimum privilege necessary for basic OpenClaw setup or local memory search.

Attack Path

1. A user enables the documented memory configuration.
2. Sensitive information is entered into an OpenClaw conversation.
3. The conversation is persisted as a session transcript.
4. Memory synchronization indexes the sessions source.
5. Transcript content is submitted to the configured remote embedding provider.
6. The data becomes subject to the provider's processing, access, logging, and retention controls.

Impact Assessment

The primary impact is loss of confidentiality and data-sovereignty control over conversation history. The affected scope can include every indexed session a ...[truncated 205 chars]

Remediation

View remediation

Remediation Suggestions

• Default to the documented local embedding provider.
• Exclude sessions from memory sources unless the user explicitly opts in.
• Display a clear warning that remote embedding sends selected content to a third party.
• Add filtering and redaction for API keys, authentication tokens, personal data, and other sensitive values before indexing.
• Permit users to select specific sessions or memory files rather than indexing all available transcripts.
• Document provider retention, training, regional processing, and deletion controls.
• Provide controls to delete both local indexes and remotely submitted batch data.
• For sensitive deployments, disable session indexing and use local-only memory processing.

T09 · Insecure Skill Coding Practices

Warning

• Location: security.md:194

Finding

Plaintext secret-file guidance omits required filesystem protections

Content

View full analysis

Vulnerability Details

File Location: security.md:194-197, referenced by SKILL.md:40-43
Vulnerability Type: Insufficiently protected plaintext credential storage
Risk Level: Medium

Vulnerable Configuration

markdown

Store in `~/.openclaw/.env`:
```bash
TELEGRAM_BOT_TOKEN=1234567890:ABC...

text

### Technical Analysis

Environment-variable substitution is preferable to embedding secrets directly in the main JSON configuration, but the recommended `.env` file remains a plaintext credential store.

The guidance does not require restrictive file permissions, verify file ownership, warn against version-control inclusion, discuss backup exposure, or recommend an operating-system or managed secret store for production environments. Depending on the user's umask and file-creation process, the file may be readable by other local accounts or copied into insecure backups.

Accessing this credential-related path is necessary for the documented configuration approach, but recommending plaintext storage without corresponding access controls exceeds a safe minimum implementation.

### Attack Path

1. A user follows the documentation and writes channel or gateway credentials to `~/.openclaw/.env`.
2. The file is created with permissive permissions, included in a backup, or accidentally copied into a repository.
3. Another local user, compromised process, backup operator, or repository reader obtains the file.
4. The exposed token is used to impersonate the bot, access configured services, or interact with the gateway according to the token's privileges.

### Impact Assessment

Impact depends on the credentials stored in the file. Exposure may allow takeover of messaging bots, unauthorized gateway access, consumption of paid APIs, access to repositories, or impersonation of the OpenClaw deployment. Because the file is presented as the common environment-variable location, compromise may reveal several service
...[truncated 28 chars]

Remediation

View remediation

Remediation Suggestions

• Require the OpenClaw directory to use mode 0700.

• Require the .env file to use mode 0600 and verify that it is owned by the service account.

• Provide secure setup commands such as:

  bash

  install -d -m 700 ~/.openclaw
  install -m 600 /dev/null ~/.openclaw/.env
  

• Explicitly prohibit committing .env files and provide appropriate ignore-rule guidance.

• Ensure diagnostics and logs never print environment-variable values.

• Exclude credential files from unencrypted backups where practical.

• Recommend OS keychains, container secret mounts, or managed secret stores for production deployments.

• Document credential rotation and immediate revocation procedures.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (23)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · automation.md (reported line 84)May include surrounding context.

md

**Actions:**
- `wake` — Wake the session
- `agent` — Send message to agent

---

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest says this skill configures OpenClaw installations with optimized settings, channel setup, security hardening, and production recommendations. This file instead documents memory search providers, session transcript indexing, filesystem memory paths, QMD backends, and LanceDB auto-capture/auto-recall features, which are a different functional area than installation/setup and security hardening.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Auto-capture and auto-recall are described without warning that potentially sensitive content may be automatically collected, stored, and later resurfaced. This creates a substantial privacy and confidentiality risk because secrets, internal discussions, or regulated data could be persistently retained and exposed through recall workflows without explicit user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documented heartbeat feature enables periodic outbound Telegram messaging to a specified user ID, but the skill does not warn operators that this creates autonomous external communications and recipient targeting. In a setup/configuration skill, that omission can lead to unintended data disclosure, surprise messaging behavior, or unsafe deployment in environments where outbound notifications require explicit consent or review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The memorySearch configuration lists third-party providers such as OpenAI, Gemini, and Voyage without warning that workspace or session-derived content may be transmitted off-host for indexing or retrieval. In a production setup skill framed as including security hardening, failing to disclose external data flow can cause unintentional exposure of sensitive memory, session, or workspace data to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly enables includeBody: true for Gmail Pub/Sub, which causes email bodies to be ingested by the system without any warning about sensitive content, data minimization, consent, retention, or access controls. In a setup skill focused on production recommendations, this can normalize collection of confidential email contents and increase the risk of privacy violations or downstream prompt/data leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The channel configuration examples show how to enable messaging integrations, including options such as open or broad access policies, but do not warn that messages may be sent to third-party platforms and upstream AI/model services. In a setup/security-hardening skill, this omission can lead users to connect personal or group chats without understanding privacy exposure, especially when permissive settings or multi-channel deployments are used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation presents multiple remote exposure options, including LAN binding and Tailnet/public access paths, but does not consistently foreground the security tradeoffs, required safeguards, or the relative risk of each mode. In a setup skill that users may follow directly, this can lead to accidental network exposure of a gateway service with weak or incomplete protection, especially where examples show enabling remote access more prominently than warning about hardening prerequisites.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Documenting indexing of past session transcripts without justification in a setup-focused skill increases the chance that operators enable collection of sensitive conversation history without understanding the privacy implications. In this context, the mismatch makes the feature more dangerous because users may trust the skill as a hardening guide while it silently broadens data retention and search scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation encourages searching workspace memory and past sessions without a user-facing privacy warning, which can lead to unintentional indexing of sensitive conversations, secrets, or personal data. Because the skill presents itself as a trusted configuration guide, users are more likely to adopt these settings without realizing the data-governance consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The recommended OpenAI embedding configuration omits that memory content may be transmitted to a remote provider for embedding, creating a risk of inadvertent third-party disclosure of sensitive workspace data. This is especially dangerous in configuration documentation because users may treat the recommendation as safe-by-default and enable it in production without a data-transfer review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The LanceDB auto-capture and auto-recall guidance introduces automatic collection and reuse of data that exceeds the skill's stated setup purpose. In a skill marketed as setup/security hardening, this can mislead users into enabling broad memory persistence features that may store or surface sensitive material unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Voice-First recommendation enables automatic TTS/transcription and a voice-call plugin that likely send audio content to third-party providers, but the guidance does not warn operators about data sharing, consent, retention, or legal/privacy implications. In a setup/recommendations skill, omission of those safeguards can cause users to deploy privacy-sensitive features by default without understanding that inbound audio and call data may leave their environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is described as OpenClaw setup and hardening guidance, but the document enables a broad 'full' tool profile plus unrelated capabilities such as browser control, media processing, TTS, and skill loading. This violates least privilege and increases attack surface because users may enable far more authority than is needed for installation or configuration tasks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Web search and fetch are configured with external providers, but the documentation does not warn users that their queries and requested URLs/page contents may be sent to third parties. This creates a data-sharing risk that is particularly problematic in a security-hardening skill, where users may search for internal hosts, secrets-adjacent paths, or sensitive operational details.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Browser control is not necessary for a setup-and-hardening skill, yet the configuration enables an interactive browser and includes a profile that can connect to Chrome. Unnecessary browser authority can expose authenticated sessions, sensitive web content, and increase the chance of unintended actions outside the setup scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation states that the 'chrome' profile uses the user's Chrome via an extension relay but omits an explicit warning that this may attach to a personal browsing context. Without that warning, users may unknowingly expose cookies, active sessions, history, or other sensitive browser state to the agent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Image, audio, and video processing are unrelated to configuring OpenClaw and needlessly expand the skill's permissions and data-handling pathways. In particular, media features may cause user content to be ingested or transmitted to external services without a setup-related justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The audio transcription section sends uploaded audio to an external provider but does not disclose that data transfer to the user. Audio often contains sensitive conversations, credentials, or personal information, so omission of this warning undermines informed consent and safe deployment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Marketplace loading, watched extra skill directories, and GitHub-backed skill installation exceed the stated purpose of setup and hardening and can introduce unreviewed code or prompts into the environment. This is especially risky in a bootstrap/configuration context because users may trust the skill's recommendations during initial deployment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The compaction section states that context may be flushed to memory when full, but it does not warn that conversation content may be persisted into longer-term storage. This is a lower-severity issue than external exfiltration, but it can still create privacy and retention risks if users assume context is ephemeral.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

TTS is outside the stated setup scope and may send message content to a third-party speech provider. While lower impact than exec or browser control, it still introduces unnecessary external data exposure and complexity in a hardening-oriented skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The TTS configuration omits a warning that message text may be sent to ElevenLabs or another external provider for speech generation. Even if lower severity, users should be informed because operational or personal content may leave the local environment when TTS is enabled.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.