Security audit

Openclaw Self Heal

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent OpenClaw repair runbook, but it can autonomously perform disruptive and access-control actions without enough validation.

Review before installing. This skill is not clearly malicious, but it should only be used where an agent is allowed to restart OpenClaw, inspect local OpenClaw config/session files, and make operator-level decisions. Pairing approvals and broad kill commands should require explicit human confirmation and request validation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: references/diagnostics.md:10
Finding: Unscoped Process Termination During Automated Recovery
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/diagnostics.md:85
Finding: Pairing Approval Can Grant Elevated Operator Access Without Request Validation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/diagnostics.md:30
Finding: Diagnostic Commands Can Expose Full Configuration and Session Data to Agent Context
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/diagnostics.md (reported line 52)May include surrounding context.
md
**Discord-specific:** 1. Check token: `openclaw status` shows token truncation — verify it's not blank 2. Check Discord status: `curl -s https://discordstatus.com/api/v2/status.json | python3 -m json.tool | grep status` 3. Restart gateway: `openclaw gateway restart` (reconnects all channels) 4. If "Invalid Token": token expired — escalate to Jake (needs new bot token)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to diagnose and remediate failures autonomously and to 'fix first, report after,' which reduces human oversight during operational changes. In an infrastructure-repair context, this can lead to unauthorized or unsafe actions such as restarts, cache clearing, service stoppage, or repeated recovery attempts that worsen outages or destroy forensic context.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: openclaw-self-heal description: Diagnose and self-resolve OpenClaw system breakage autonomously. Use when: the Control UI / webchat is broken or unreachable, a channel (Discord, Telegram) goes offline or stops responding, the gateway crashes or won't start, memory/plugins report errors, pairing fails, or any OpenClaw component appears broken. Also use proactively during heartbeats when `openclaw status` shows errors. Resolves issues without asking Jake unless the fix requires destructive action or manual intervention. --- # openclaw-self-heal

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The guidance recommends pkill -f openclaw to resolve startup issues, which can terminate all matching processes without warning about service interruption, active sessions, or potential data loss. In an operational troubleshooting skill, users may copy-paste this command directly, making unintended disruption reasonably likely.
Content: No source excerpt is available for this finding.

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · references/diagnostics.md (reported line 95)May include surrounding context.
md
**Symptoms:** Session history not loading, "chat.history" errors in logs, blank chat in UI **Fix sequence:** 1. Check sessions file: `ls -la ~/.openclaw/agents/main/sessions/` 2. Check for JSON corruption: `python3 -m json.tool ~/.openclaw/agents/main/sessions/sessions.json` 3. Gateway restart clears in-memory session state: `openclaw gateway restart`

Static analysis

No suspicious patterns detected.