Security audit
Security checks for vulnerabilities and agentic risk
This skill has a coherent security-dashboard purpose, but it under-discloses host registration, broad local configuration parsing, and an optional background daemon that keeps watching and syncing after invocation.
Review this skill before installing. It may be acceptable if you trust Clawned and want hosted security inventory, but treat CLAWNED_SERVER as sensitive, avoid pointing it at untrusted or plaintext endpoints, and be aware that the daemon/watch modes can keep inspecting installed skills and syncing metadata after the original command finishes.
scripts/agent.py:15API Credential Can Be Transmitted to an Arbitrary or Plaintext Endpoint
scripts/agent.py:64Complete Secret-Bearing OpenClaw Configuration Is Read Despite a Narrow Privacy Claim
scripts/agent.py:186Host Identity Is Transmitted Despite the Claim That Sync Sends Only Skill Metadata
scripts/agent.py:322Undocumented Detached Daemon Provides Cross-Session Monitoring and Network Synchronization
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
headers={"Authorization": f"Bearer {CLAWNED_API_KEY}", "Content-Type": "application/json",
"User-Agent": "ClawnedAgent/1.0"})
try:
with urllib.request.urlopen(req, timeout=60) as resp:
return json.loads(resp.read().decode())
except urllib.error.HTTPError as e:
print(f"[!] API error {e.code}: {e.read().decode() if e.fp else ''}"); sys.exit(1)
The documented behavior emphasizes security analysis, but the skill also describes inventory collection and remote synchronization of locally discovered skills, and the static finding indicates additional host registration and persistent monitoring behaviors not transparently disclosed in the user-facing description. A security-themed skill with hidden or understated telemetry/orchestration behavior is especially risky because users are more likely to trust it with broad local access, which could enable stealthy exfiltration of metadata or source contents.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- FP Context: Documentation references vs actual file reads
### CRED-002: SSH key access
- Pattern: `\.ssh/id_`, `\.ssh/authorized_keys`, `\.ssh/config`
- Severity: CRITICAL
- Confidence: CONFIRMED
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Confidence: CONFIRMED
### CRED-003: Cloud credential access
- Pattern: `\.aws/credentials`, `\.aws/config`, `\.gcloud/`, `\.azure/`
- Pattern: `\.kube/config`, `\.docker/config\.json`
- Severity: CRITICAL
- Confidence: CONFIRMED
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Confidence: CONFIRMED
### CRED-003: Cloud credential access
- Pattern: `\.aws/credentials`, `\.aws/config`, `\.gcloud/`, `\.azure/`
- Pattern: `\.kube/config`, `\.docker/config\.json`
- Severity: CRITICAL
- Confidence: CONFIRMED
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Confidence: CONFIRMED
### CRED-003: Cloud credential access
- Pattern: `\.aws/credentials`, `\.aws/config`, `\.gcloud/`, `\.azure/`
- Pattern: `\.kube/config`, `\.docker/config\.json`
- Severity: CRITICAL
- Confidence: CONFIRMED
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### CRED-003: Cloud credential access
- Pattern: `\.aws/credentials`, `\.aws/config`, `\.gcloud/`, `\.azure/`
- Pattern: `\.kube/config`, `\.docker/config\.json`
- Severity: CRITICAL
- Confidence: CONFIRMED
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- FP Context: Skills legitimately read specific env vars — flag bulk access
### CRED-005: Browser credential access
- Pattern: `Chrome/Default/Login`, `Firefox/Profiles`, `Cookies`, `\.mozilla`
- Severity: CRITICAL
- Confidence: CONFIRMED
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Severity: CRITICAL
- Confidence: CONFIRMED
### CRED-006: Keychain access
- Pattern: `security\s+find-.*-password`, `keyring`, `keychain`
- Severity: CRITICAL
- Confidence: LIKELY
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
# Threat Model — OpenClaw Skill Security
## Attack Surface Overview
OpenClaw skills execute with the **host user's permissions**. A malicious skill has access to:
- The full filesystem (read/write as the running user)
- Network (outbound connections)
- Environment variables (including injected API keys and secrets)
- The OpenClaw agent's context (prompt injection to control agent behavior)
- Other skills' configuration via `~/.openclaw/openclaw.json`
- Messaging platform tokens (Telegram, WhatsApp, Discord bots)
## Threat Categories
### T1: Remote Code Execution (CRITICAL)
**Vector**: Scripts tha
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
**Vector**: Scripts that download and execute code from remote sources at runtime.
**Patterns**:
- `curl|bash`, `wget|sh`, `curl|python`
- `eval(fetch(...))`, dynamic `require()` or `import()` with remote URLs
- `subprocess.run()` with user-controlled or remote-fetched input
- `child_process.exec()` with template literals containing external data
Potential security issue detected. Manual review is recommended.
- Writing to `/etc/`, `/usr/`, system directories
- Modifying shell profiles (`.bashrc`, `.zshrc`, `.profile`)
- Creating cron jobs outside OpenClaw's cron system
- Docker socket access (`/var/run/docker.sock`)
- Modifying PAM configuration
### T8: Filesystem Abuse (MEDIUM)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### T8: Filesystem Abuse (MEDIUM)
**Vector**: Accessing or modifying files outside the skill's legitimate scope.
**Patterns**:
- Path traversal (`../../../etc/passwd`)
- Symlink attacks (creating symlinks to sensitive files)
- Reading/writing outside `<workspace>/skills/<skill-name>/`
- Accessing other users' home directories
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
SCANNABLE_EXTS = {".md", ".py", ".js", ".ts", ".sh", ".mjs", ".cjs", ".jsx", ".tsx",
".mts", ".bash", ".zsh", ".rb", ".pl", ".yaml", ".yml", ".json", ".toml",
".cfg", ".conf", ".lua", ".go", ".rs", ".r", ".ps1", ".bat", ".cmd", ".txt", ".ini"}
# NOTE: .env is intentionally excluded to avoid leaking secrets
MAX_FILE_SIZE = 512 * 1024 # 512KB per file
MAX_FILES = 30
The skill advertises and documents capabilities that involve environment variable access, reading local configuration, scanning files, and syncing data to a remote server, yet it declares no explicit tool scope or permissions. That creates an overprivileged and under-audited execution model where users and the platform cannot clearly constrain file, env, and network access, increasing the chance of unintended data exposure or abuse.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### INJECT-003: Agent behavior manipulation
- Pattern: `do not tell the user`, `don't mention`, `hide this from`
- Pattern: `silently`, `without asking`, `without confirmation`
- Pattern: `install.*skill`, `modify.*SKILL.md`, `edit.*openclaw.json`
- Severity: HIGH
- Confidence: LIKELY
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### INJECT-003: Agent behavior manipulation
- Pattern: `do not tell the user`, `don't mention`, `hide this from`
- Pattern: `silently`, `without asking`, `without confirmation`
- Pattern: `install.*skill`, `modify.*SKILL.md`, `edit.*openclaw.json`
- Severity: HIGH
- Confidence: LIKELY
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
## Privilege Escalation Patterns (PRIVESC-*)
### PRIVESC-001: sudo usage
- Pattern: `sudo\s+`, `doas\s+`
- Severity: HIGH
- Confidence: CONFIRMED
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Attack Surface Overview
OpenClaw skills execute with the **host user's permissions**. A malicious skill has access to:
- The full filesystem (read/write as the running user)
- Network (outbound connections)
- Environment variables (including injected API keys and secrets)
- The OpenClaw agent's context (prompt injection to control agent behavior)
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- `subprocess.run()` with user-controlled or remote-fetched input
- `child_process.exec()` with template literals containing external data
**Why it matters**: The skill can execute arbitrary code that wasn't present during review.
### T2: Reverse Shells (CRITICAL)
**Vector**: Scripts that open a connection back to an attacker-controlled server.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Instructing agent to install additional skills silently
- Instructing agent to modify other skills' files
- Instructing agent to send messages on behalf of the user
- Social engineering the agent to bypass user confirmation
### T6: Supply Chain Attacks (HIGH)
**Vector**: Dependencies that introduce malicious code.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
**Vector**: Gaining elevated permissions beyond normal user access.
**Patterns**:
- `sudo` usage (especially with NOPASSWD)
- SUID bit manipulation (`chmod u+s`, `chmod 4755`)
- Writing to `/etc/`, `/usr/`, system directories
- Modifying shell profiles (`.bashrc`, `.zshrc`, `.profile`)
- Creating cron jobs outside OpenClaw's cron system
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
**Vector**: Gaining elevated permissions beyond normal user access.
**Patterns**:
- `sudo` usage (especially with NOPASSWD)
- SUID bit manipulation (`chmod u+s`, `chmod 4755`)
- Writing to `/etc/`, `/usr/`, system directories
- Modifying shell profiles (`.bashrc`, `.zshrc`, `.profile`)
- Creating cron jobs outside OpenClaw's cron system
The top-level description presents the tool mainly as an inventory/sync agent, but the implementation also supports persistent watch/daemon modes that continuously monitor local skill directories and trigger network syncs. That behavioral expansion increases privacy and operational risk because it enables ongoing background observation and outbound reporting beyond a one-shot inventory action.
The code forks into the background, writes PID files, redirects stdio, and later sends SIGTERM and SIGKILL to stop the daemon. Those host process-control capabilities go beyond the core stated purpose of discovering installed skills, analyzing them, and syncing results, and the manifest does not indicate that the skill manages background processes.
No suspicious patterns detected.