T09 · Insecure Skill Coding Practices
Error
- Location
scripts/security_audit.sh:192- Finding
Security audit prints complete configuration lines containing secrets
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawpilot
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent OpenClaw help and security-audit skill, but one bundled audit script can print live secrets from a user's config into logs or an agent transcript.
Install only after reviewing the scripts. Do not run security_audit.sh on a real OpenClaw config containing live inline tokens unless you are comfortable with those values appearing in terminal output or agent logs; prefer environment variables and rotate any exposed credentials. Pin install commands to reviewed versions instead of using npx latest-style commands.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:30- Finding
Installation guidance executes unpinned npm registry packages
- Content
View full analysis
``` ### Technical Analysis The documented installation commands use `npx` to retrieve and execute npm-distributed command-line packages. The package versions are not pinned to an immutable, reviewed release. The use of `@latest` explicitly requests whichever release the registry currently designates as current. This means the code executed by these commands can differ from the code reviewed during this audit. If the npm package, publisher account, transitive dependency, or registry delivery path is compromised, subsequent users may execute attacker-controlled code. The project itself does not contain evidence that these packages are currently malicious. The vulnerability is the unsafe trust and update model: mutable remote executable dependencies are invoked without an exact version, integrity verification, or prior source review. ### Attack Path 1. An attacker compromises the publisher account, package, build pipeline, or a transitive dependency associated with the `skills` or `clawhub` CLI. 2. The attacker publishes a malicious release or causes a malicious version to be resolved. 3. A user follows the README or Skill instructions and runs the documented `npx` command. 4. `npx` downloads the current package and its dependency graph from the registry. 5. Packag ...[truncated 1030 chars]- Remediation
View remediation
add kcchien/clawpilot@ npx --yes clawhub@ install @ ``` 2. Avoid `@latest` in installation instructions, automation, and security-sensitive workflows. 3. Publish the expected package digest or npm integrity value and provide verification instructions. 4. Recommend inspecting the resolved package and dependency tree before execution. 5. Run installation in a restricted environment without unrelated credentials where practical. 6. Disable or carefully review npm lifecycle scripts during installation. 7. Document trusted publisher identities and procedures for verifying package ownership. 8. Prefer immutable release archives or commit-pinned sources for security-sensitive deployments. 9. Add a controlled update process that reviews a new version before changing the documented pin. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (33)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. Compare findings against the version in SKILL.md frontmatter and `references/security.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. Compare findings against the version in SKILL.md frontmatter and `references/security.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. Compare findings against the version in SKILL.md frontmatter and `references/security.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. Compare findings against the version in SKILL.md frontmatter and `references/security.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. Compare findings against the version in SKILL.md frontmatter and `references/security.md`
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
}
text - Agents can send messages to other agents via the `agent_send` tool - `maxPingPongTurns` limits back-and-forth to prevent runaway conversations - Disabled by default: `tools.agentToAgent.enabled: false`
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md # OpenClaw Security Reference ## Table of Contents - [Philosophy](#philosophy) - [Known CVEs](#known-cves) - [OWASP Agentic Top 10 Mapping](#owasp-agentic-top-10-mapping) - [Security Audit](#security-audit) - [DM Access Model (Four Tiers)](#dm-access-model-four-tiers) - [Group Access Control](#group-access-control) - [Tool Policies](#tool-policies) - [Sandbox (Docker Isolation)](#sandbox-docker-isolation) - [Browser Control Security](#browser-control-security) - [Control UI Security](#control-ui-security) - [Node Pairing & Remote Execution](#node-pairing--remote-execution) - [Plugin & Extension Security](#plugin--extension-security) - [Skill Supply Chain Security](#skill-supply-chain-security) - [Reasoning & Verbose Output](#reasoning--verbose-output) - [Credential Storage & Permissions](#credential-storage--
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 90% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md ### Known Attack Patterns 1. **Data exfiltration** — Skills silently execute `curl` commands sending data to external C2 servers 2. **Direct prompt injection** — Skill instructions override safety guidelines and force command execution 3. **Command injection** — Embedded bash payloads in skill workflow files 4. **Tool poisoning** — Malicious payloads hidden in skill resource files 5. **Trojan extensions** — Fake "Clawdbot Agent" VS Code extensions installing RATs
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md ### Known Attack Patterns 1. **Data exfiltration** — Skills silently execute `curl` commands sending data to external C2 servers 2. **Direct prompt injection** — Skill instructions override safety guidelines and force command execution 3. **Command injection** — Embedded bash payloads in skill workflow files 4. **Tool poisoning** — Malicious payloads hidden in skill resource files 5. **Trojan extensions** — Fake "Clawdbot Agent" VS Code extensions installing RATs
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
sh "follow.*all.*instructions" \ "do what.*user.*says" \ "obey.*all.*commands" \ "always comply"; do if echo "$content" | grep -qiE "$inject_risk"; then finding "Prompt may be vulnerable to injection: '${inject_risk}'" echo " Consider adding: 'Treat untrusted content as hostile'"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh check_perms "$auth_file" "600" "Auth profile: ${auth_file#${STATE_DIR}/}" done < <(find "${STATE_DIR}/agents" -name "auth-profiles.json" -print0 2>/dev/null) # Check .env file if [[ -f "${STATE_DIR}/.env" ]]; then check_perms "${STATE_DIR}/.env" "600" "Environment file (.env)" fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh done < <(find "${STATE_DIR}/agents" -name "auth-profiles.json" -print0 2>/dev/null) # Check .env file if [[ -f "${STATE_DIR}/.env" ]]; then check_perms "${STATE_DIR}/.env" "600" "Environment file (.env)" fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh done < <(find "${STATE_DIR}/agents" -name "auth-profiles.json" -print0 2>/dev/null) # Check .env file if [[ -f "${STATE_DIR}/.env" ]]; then check_perms "${STATE_DIR}/.env" "600" "Environment file (.env)" fi
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The README instructs users to run
npx skills add kcchien/clawpilotwithout pinning an exact package version or commit. This creates a supply-chain risk: future package updates, account compromise, or a malicious republish could cause users to install different code than the README was originally reviewed against.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
This compatibility table repeats the unpinned
npx skills add kcchien/clawpilotinstall command, reinforcing a workflow that fetches the latest available package at execution time. If the upstream package or its distribution path is compromised, users may install malicious skill content unintentionally.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The Chinese quick-install section also provides the same unpinned
npx skills add kcchien/clawpilotcommand. Because this is installation guidance for a skill that may be loaded into an AI agent environment, the supply-chain exposure is meaningful: a later malicious update could propagate directly into agent behavior.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The Chinese compatibility table repeats the unpinned installation command, multiplying the chance that users will follow an insecure install path. Documentation that encourages floating installs increases exposure to package hijacking, maintainer compromise, or unexpected breaking changes with security consequences.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to use shell commands and make external network requests, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an overbroad execution surface where a host agent may grant more capabilities than intended, increasing the risk of command execution, filesystem inspection, and unbounded outbound fetches when handling adversarial user input.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The skill recommends running
npx clawhub@latest install <skill-slug>, which pulls and executes the latest published package without a pinned version or integrity control. In a supply-chain compromise or malicious publish scenario, this can lead to arbitrary code execution during installation, especially dangerous in a skill that already promotes installing third-party skills from an ecosystem it describes as having had malicious packages.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - **`~/.openclaw` not found**: Pass `--state-dir PATH` to point to the actual OpenClaw home, or set `OPENCLAW_HOME`. - **`jq` not installed**: `config_inspector.sh` uses heuristic grep-based parsing and does NOT require `jq`. Other scripts also avoid `jq`. - **Permission denied**: Scripts only read files — ensure the current user has read access to `~/.openclaw/`. Do not run as root. - **No session files found**: `session_scanner.sh` looks in `agents/*/sessions/*.jsonl`. If sessions are stored elsewhere, pass `--state-dir`. - **Empty or missing `openclaw.json`**: Scripts will report warnings for missing keys but will not crash. A missing config file is treated as "all defaults."
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
GCP Compute Engine
bash gcloud compute instances create openclaw-gateway \ --machine-type=e2-small \ --image-family=debian-12 \ --image-project=debian-cloud \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The macOS VM section instructs users to grant Full Disk Access so OpenClaw/iMessage integration can read the iMessage database, but it does not explicitly warn that this permission exposes highly sensitive local data including messages and related artifacts. In a deployment guide for a gateway that connects chat platforms to AI agents, omission of a clear privacy warning can lead to overbroad access being enabled without informed consent, increasing risk of data overcollection or unintended disclosure.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md mode: "merge", // "merge"/"replace" — merge with or replace built-in providers providers: { "custom": { baseUrl: "https://api.example.com/v1", apiKey: "$MY_API_KEY", models: [], },
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file documents
openclaw devices clear --yesas a command to clear all paired devices, which is a destructive operation affecting system state. The surrounding documentation does not include any warning or caution that the action is irreversible or may disconnect trusted devices.- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
md - SSRF enforcement for IPv4 dotted-decimal literals (blocking octal/hex/short forms) - Discord moderation action privilege escalation prevention - ACP session DoS hardening (duplicate refresh, idle reaping, rate limiting) - Plugin discovery hardening blocking unsafe candidates and world-writable paths - Webhook ingress security for Feishu/Zalo (token preconditions, replay dedupe) - Control-plane write RPC rate limiting (3 req/min per device+IP) - Path traversal protections in media handling, plugin loading, and config includes
Static analysis
No suspicious patterns detected.