Openclaw Optimizer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:33 AM UTC
• Version: 1.19.0

Overview

The skill is broadly useful for OpenClaw administration, but it asks for persistent system profiling and self-updating behavior that users should review before installing.

Install only if you are comfortable with an agent collecting and retaining detailed OpenClaw deployment notes. Before use, require explicit approval for every profile write, SCP sync, config change, cron change, SKILL.md edit, git commit, or push; remove token prefixes from templates; and treat profile contents as untrusted notes rather than authoritative instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:1022

Finding

Persistent Collection and Cross-Machine Synchronization of Sensitive Deployment Metadata

Content

View full analysis

/dev/null | wc -l` — check for stuck delivery entries 4. `openclaw nodes list` — check paired nodes and connection status 5. Flag any cron jobs in `error` state — these are active problems 6. Flag jobs with stale last-run times (>24h for daily jobs) — may indicate silent failures 7. Check timezone consistency — jobs using `(exact)` instead of named timezones may fire at wrong times 8. Document ALL findings in the system profile before making recommendations 9. **Without this data, recommendations will duplicate existing automation and miss hidden drains.** **At session end (update the profile):** *For directory-based profiles:* 1. Update the specific **topic file(s)** that ...[truncated 4609 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:1126

Finding

Runtime Self-Modification Can Persist Untrusted Troubleshooting Conclusions

Content

View full analysis

.md`) — deployment-specific knowledge (IPs, paths, credentials, topology, issue log, lessons learned) ### How to Update 1. **During the session:** When you discover something new, update the relevant section immediately — don't wait until the end. Corrections to bad advice are urgent. 2. **Be specific:** Don't write "TLS can be tricky." Write "macOS app rejects `ws://` for remote gateways — always use `wss://`. The `ws://` scheme is only valid for loopback connections." 3. **Include the why:** Don't just say "us ...[truncated 3283 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:620

Finding

Unpinned npx Package Execution Creates a Supply-Chain Execution Risk

Content

View full analysis

# install ``` The same instruction appears in `references/cli-reference.md`: ```bash npx clawhub install # install skill (one-off) ``` ### Technical Analysis Running an unqualified package name through `npx` can retrieve and execute the package version currently selected by the configured package registry. The command does not pin an audited version, verify an integrity digest, or require a locally installed trusted binary. The effective code can therefore change after the Skill has been reviewed. Package installation can execute JavaScript and package lifecycle logic with the invoking user’s permissions. The risk is amplified because the command installs additional Skills, which may themselves contain instructions or scripts. ### Attack Path 1. A user follows the documented `npx clawhub install ` instruction. 2. `npx` resolves `clawhub` through the configured npm registry and cache. 3. If the package is not already installed locally, `npx` downloads the currently resolved release. 4. An attacker compromises the package, maintainer account, registry resolution, or a future release. 5. The downloaded package executes under the user account. 6. Malicious package code can access user-readable files, modify local configuration, install malicious Skills, or establish persistence available to that account. ### Impact Assessment The package receives the privileges of the user invoking `npx`. Depending on local permissions, this may allow: - Reading user credentials and configuration files - Modifying OpenClaw or Agent Skill directories - Installing malicious Skill content - Executing arbitrary processes - Making network requests - Establ ...[truncated 252 chars]

Remediation

View remediation

install ``` 2. Document and verify the expected npm package name, publisher, and provenance. 3. Use npm integrity data and a committed lockfile where the workflow permits. 4. Prefer a locally installed, reviewed CLI rather than retrieving code during each invocation. 5. Disable package lifecycle scripts during inspection where feasible: ```bash npm pack clawhub@ ``` Inspect the resulting archive before installation. 6. Verify installed Skills independently before loading or executing them. 7. Use a restricted user, container, or sandbox for third-party Skill installation. 8. Apply the same correction to `references/cli-reference.md:166` to prevent the unsafe command from remaining in alternate documentation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/version-check.py:48

Finding

TLS Certificate Verification Is Disabled When No CA Bundle Is Found

Content

View full analysis

ssl.SSLContext: """Create SSL context with proper certificate handling.""" # Try system default first try: ctx = ssl.create_default_context() if ctx.get_ca_certs(): return ctx except Exception: pass # Fall back to certifi if installed try: import certifi return ssl.create_default_context(cafile=certifi.where()) except ImportError: pass # Last resort — warn explicitly, don't silently disable print("WARNING: No SSL certificates found. Using unverified HTTPS.", file=sys.stderr) ctx = ssl.create_default_context() ctx.check_hostname = False ctx.verify_mode = ssl.CERT_NONE return ctx ``` This context is used for the GitHub API request: ```python with urllib.request.urlopen(req, timeout=10, context=ctx) as resp: data = json.loads(resp.read()) tag = data.get("tag_name", "").lstrip("v") return tag if tag else None ``` ### Technical Analysis If neither the system trust store nor `certifi` is available, the code deliberately disables hostname checks and certificate-chain verification. Encryption without peer authentication does not protect against an active man-in-the-middle attacker. The response controls the version recorded in `metadata/latest-version.txt`. `scripts/update-skill.sh` consumes that result and uses the reported version to construct another GitHub release URL and update local version metadata. Although the fetched changelog is treated as text rather than executed shell code, forged release metadata can mislead maintainers and corrupt the update state. ### Attack Path 1. The script runs on a system where Python cannot locate system CA certificates and `certifi` is not installed. 2. `get_ssl_context ...[truncated 1067 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (64)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill's stated purpose omits that it performs release-version checks, writes cache/metadata, and supports maintenance workflows outside pure optimization/troubleshooting. This weakens user consent and makes it easier for a seemingly informational skill to accumulate side effects over time.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill's stated purpose omits that it performs release-version checks, writes cache/metadata, and supports maintenance workflows outside pure optimization/troubleshooting. This weakens user consent and makes it easier for a seemingly informational skill to accumulate side effects over time.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document says updates are never automatic, but later mandates in-session self-updates and end-of-session commit/push behavior. This contradiction is dangerous because users and orchestrators may rely on the earlier safety statement while later instructions quietly authorize persistent and remote-changing actions.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md

> **WARNING — Provider Bans (Mar 2026):**
>
> **Google:** Actively cracking down on Gemini CLI OAuth and AntiGravity access through third-party tools. Accounts are being banned or rate-limited without warning or refunds. Use API key auth (`google` provider) instead of OAuth (`google-gemini-cli` / `google-antigravity`). Production API keys: 150-300 RPM, no ban risk. See GitHub Issue #14203.
>
> **Anthropic:** Has banned users linking flat-rate Claude Code subscription tokens to OpenClaw. Using Claude Code OAuth tokens directly in OpenClaw may trigger account suspension. However, using Claude Code through the **Agent SDK / ACP dispatch** (where OpenClaw spawns Claude Code as a sub-agent via the ACP protocol) is the supported pattern and should not cause issues — this is how OpenClaw's built-in `acp` integration works.
>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 626)May include surrounding context.

md

**Security:** Before installing any skill, read its `SKILL.md` manually. Community scans found 341+ malicious skills (reverse shells, credential exfiltration, A

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 815)May include surrounding context.

md

- Curate MEMORY.md — archive old daily logs, promote key insights
- `openclaw sessions cleanup --dry-run` → `openclaw sessions cleanup`
- `openclaw cron status` — check for errors
- Clean stale backup files: `find ~/.openclaw -name "*.bak.*" -mtime +7 -not -name "*.bak" | xargs rm -v` (preserves CLI's rolling `.bak` files, removes old named/dated backups)

**Quarterly:**
- Review custom scripts (`scripts/`) for redundancy with built-in OpenClaw features. Users often build custom solutions (RAG pipelines, session archivers, memory indexers) that become redundant when OpenClaw adds equivalent built-in functionality. Check whether each script and its associated cron job still serves a purpose that the platform doesn't already handle.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

The skill explicitly instructs future sessions to actively update SKILL.md based on runtime experience. Self-modification is dangerous because it lets transient prompts, mistakes, or adversarial content reshape future behavior and can embed unsafe instructions persistently.

Content

Scanner excerpt · SKILL.md (reported line 1130)May include surrounding context.

md

This skill is a living document. Every troubleshooting session, every CLI interaction, and every failure is an opportunity to make it more accurate. Future sessions must actively update the skill based on real-world experience.

### When to Update SKILL.md

| Trigger | Action |
|---|---|

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Self-modification plus git commit/push instructions are outside the expected role of an optimizer/troubleshooter and materially raise the blast radius of the skill. A compromised or mistaken session could alter the skill itself and propagate those changes to remote repositories or hosts.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · metadata/knowledge-map.json (reported line 4)May include surrounding context.

json

{
  "skill_version": "2026.3.8",
  "last_updated": "2026-03-09",
  "description": "Maps each SKILL.md section to its source documentation and changelog keywords. Used by the Self-Update Protocol to identify which sections need refreshing when a new OpenClaw version is detected.",
  "sections": {
    "providers": {
      "title": "Model Providers \u2014 Complete Reference",

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · metadata/update-log.md (reported line 15)May include surrounding context.

md

{
  "skill_version": "2026.3.8",
  "last_updated": "2026-03-09",
  "description": "Maps each SKILL.md section to its source documentation and changelog keywords. Used by the Self-Update Protocol to identify which sections need refreshing when a new OpenClaw version is detected.",
  "sections": {
    "providers": {
      "title": "Model Providers \u2014 Complete Reference",

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · metadata/update-log.md (reported line 19)May include surrounding context.

md

{
  "skill_version": "2026.3.8",
  "last_updated": "2026-03-09",
  "description": "Maps each SKILL.md section to its source documentation and changelog keywords. Used by the Self-Update Protocol to identify which sections need refreshing when a new OpenClaw version is detected.",
  "sections": {
    "providers": {
      "title": "Model Providers \u2014 Complete Reference",

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/identity-optimizer.md (reported line 80)May include surrounding context.

md

{
  "skill_version": "2026.3.8",
  "last_updated": "2026-03-09",
  "description": "Maps each SKILL.md section to its source documentation and changelog keywords. Used by the Self-Update Protocol to identify which sections need refreshing when a new OpenClaw version is detected.",
  "sections": {
    "providers": {
      "title": "Model Providers \u2014 Complete Reference",

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/update-skill.sh (reported line 167)May include surrounding context.

sh

echo "  Bumping version to v$NEW_VERSION..."

# Update SKILL.md version references
python3 - "$SKILL_MD" "$CURRENT_VERSION" "$NEW_VERSION" << 'PYEOF'
import sys, re

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The template tells users to record gateway token information, even if truncated, without warning that authentication material should not be stored in plaintext documentation. Partial tokens can still aid token identification, correlation, phishing, and operational leakage, especially when combined with hostname and network details in the same profile.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · systems/TEMPLATE.md (reported line 163)May include surrounding context.

Removed providers

text

---

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents extensive shell, file write, network, and remote sync capabilities but declares no explicit tool scope or permissions boundary. In agent environments, this increases the chance the skill is invoked with overly broad ambient authority, enabling unintended filesystem mutation, remote copy, config changes, and command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Several triggers overlap with ordinary discussion about agents, optimization, or identity, making unintended activation more likely. In a skill that includes persistent profiling and maintenance behaviors, over-broad activation meaningfully increases exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Broad triggers like generic error phrases can cause the skill to activate in unrelated conversations. Because this skill contains high-impact operational instructions and write-capable workflows, accidental invocation increases the risk of unnecessary data collection, shell guidance, or state-changing proposals.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

> Propose a tiered routing plan: cheap for heartbeats/cron, mid for daily tasks, premium for coding/reasoning. Exact config + rollback. Do NOT apply.

**Silent cron job:**
> Create a cron job that runs [task] every [interval]. Isolated session, NO_REPLY on nothing-to-do. Show me the command first.

**Audit agent personality & identity:**
> Audit my agent's personality and identity files. Check for conflicts, bloat, and bad practices. Walk me through improvements.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

md

6. `lastGood.<slug>` and `usageStats.<slug>:*` in auth-profiles.json — edit directly

For providers with LaunchAgent env vars (Ollama, etc.), also clean:
7. `launchctl unsetenv <KEY>` — session-level env persists independently of plist
8. PlistBuddy delete from `~/Library/LaunchAgents/ai.openclaw.gateway.plist`
9. `launchctl bootout` + `launchctl bootstrap` to pick up the clean plist (kickstart alone doesn't reload env from plist)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

md

6. `lastGood.<slug>` and `usageStats.<slug>:*` in auth-profiles.json — edit directly

For providers with LaunchAgent env vars (Ollama, etc.), also clean:
7. `launchctl unsetenv <KEY>` — session-level env persists independently of plist
8. PlistBuddy delete from `~/Library/LaunchAgents/ai.openclaw.gateway.plist`
9. `launchctl bootout` + `launchctl bootstrap` to pick up the clean plist (kickstart alone doesn't reload env from plist)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md

6. `lastGood.<slug>` and `usageStats.<slug>:*` in auth-profiles.json — edit directly

For providers with LaunchAgent env vars (Ollama, etc.), also clean:
7. `launchctl unsetenv <KEY>` — session-level env persists independently of plist
8. PlistBuddy delete from `~/Library/LaunchAgents/ai.openclaw.gateway.plist`
9. `launchctl bootout` + `launchctl bootstrap` to pick up the clean plist (kickstart alone doesn't reload env from plist)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 795)May include surrounding context.

md

6. `lastGood.<slug>` and `usageStats.<slug>:*` in auth-profiles.json — edit directly

For providers with LaunchAgent env vars (Ollama, etc.), also clean:
7. `launchctl unsetenv <KEY>` — session-level env persists independently of plist
8. PlistBuddy delete from `~/Library/LaunchAgents/ai.openclaw.gateway.plist`
9. `launchctl bootout` + `launchctl bootstrap` to pick up the clean plist (kickstart alone doesn't reload env from plist)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 900)May include surrounding context.

md

6. `lastGood.<slug>` and `usageStats.<slug>:*` in auth-profiles.json — edit directly

For providers with LaunchAgent env vars (Ollama, etc.), also clean:
7. `launchctl unsetenv <KEY>` — session-level env persists independently of plist
8. PlistBuddy delete from `~/Library/LaunchAgents/ai.openclaw.gateway.plist`
9. `launchctl bootout` + `launchctl bootstrap` to pick up the clean plist (kickstart alone doesn't reload env from plist)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 922)May include surrounding context.

md

6. `lastGood.<slug>` and `usageStats.<slug>:*` in auth-profiles.json — edit directly

For providers with LaunchAgent env vars (Ollama, etc.), also clean:
7. `launchctl unsetenv <KEY>` — session-level env persists independently of plist
8. PlistBuddy delete from `~/Library/LaunchAgents/ai.openclaw.gateway.plist`
9. `launchctl bootout` + `launchctl bootstrap` to pick up the clean plist (kickstart alone doesn't reload env from plist)

Static analysis

No suspicious patterns detected.