OpenClaw Security Scanner

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:52 PM UTC
• Version: 1.0.0

Overview

This is a local OpenClaw security scanner, but its optional auto-fix mode uses unsafe shell evaluation that can run unintended commands in some setups.

Use the read-only scan mode first. Avoid --fix unless you have reviewed the script or the eval-based auto-fix implementation has been removed; if you do run --fix, use a trusted simple OPENCLAW_HOME path and confirm only fixes you understand.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: oc-security-scan.sh:159

Finding

Arbitrary Command Execution Through Unsafe Auto-Fix Evaluation

Content

View full analysis

Remediation

View remediation

&2 return 1 ;; esac ``` 4. Use `--` before path operands where supported so paths beginning with a hyphen cannot be interpreted as command-line options. 5. For `.gitignore` updates, avoid dynamically generated `echo -e` commands. Write fixed patterns directly with `printf`: ```bash printf '%s\n' "${missing_patterns[@]}" >> "$gitignore" ``` 6. Validate `OPENCLAW_HOME` before use. Validation is defense in depth and must not replace removal of `eval`. 7. Preserve the confirmation prompt, but display the operation and literal target separately rather than displaying executable shell text. 8. Add regression tests using paths containing spaces, quotes, semicolons, command substitutions, newlines, leading hyphens, and wildcard characters. Verify that these values are treated strictly as literal filesystem paths. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (43)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · oc-security-scan.sh (reported line 31)May include surrounding context.

sh

# OpenClaw paths (defaults, overridden by detection)
OC_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
OC_CONFIG="$OC_HOME/openclaw.json"
OC_SECRETS="$OC_HOME/secrets.env"
OC_WORKSPACE="$OC_HOME/workspace"

# Scoring

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · oc-security-scan.sh (reported line 300)May include surrounding context.

sh

# OpenClaw paths (defaults, overridden by detection)
OC_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
OC_CONFIG="$OC_HOME/openclaw.json"
OC_SECRETS="$OC_HOME/secrets.env"
OC_WORKSPACE="$OC_HOME/workspace"

# Scoring

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · oc-security-scan.sh (reported line 301)May include surrounding context.

sh

# OpenClaw paths (defaults, overridden by detection)
OC_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
OC_CONFIG="$OC_HOME/openclaw.json"
OC_SECRETS="$OC_HOME/secrets.env"
OC_WORKSPACE="$OC_HOME/workspace"

# Scoring

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · oc-security-scan.sh (reported line 303)May include surrounding context.

sh

# OpenClaw paths (defaults, overridden by detection)
OC_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
OC_CONFIG="$OC_HOME/openclaw.json"
OC_SECRETS="$OC_HOME/secrets.env"
OC_WORKSPACE="$OC_HOME/workspace"

# Scoring

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · oc-security-scan.sh (reported line 304)May include surrounding context.

sh

# OpenClaw paths (defaults, overridden by detection)
OC_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
OC_CONFIG="$OC_HOME/openclaw.json"
OC_SECRETS="$OC_HOME/secrets.env"
OC_WORKSPACE="$OC_HOME/workspace"

# Scoring

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · oc-security-scan.sh (reported line 306)May include surrounding context.

sh

# OpenClaw paths (defaults, overridden by detection)
OC_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
OC_CONFIG="$OC_HOME/openclaw.json"
OC_SECRETS="$OC_HOME/secrets.env"
OC_WORKSPACE="$OC_HOME/workspace"

# Scoring

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · oc-security-scan.sh (reported line 313)May include surrounding context.

sh

# OpenClaw paths (defaults, overridden by detection)
OC_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
OC_CONFIG="$OC_HOME/openclaw.json"
OC_SECRETS="$OC_HOME/secrets.env"
OC_WORKSPACE="$OC_HOME/workspace"

# Scoring

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · oc-security-scan.sh (reported line 317)May include surrounding context.

sh

# OpenClaw paths (defaults, overridden by detection)
OC_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
OC_CONFIG="$OC_HOME/openclaw.json"
OC_SECRETS="$OC_HOME/secrets.env"
OC_WORKSPACE="$OC_HOME/workspace"

# Scoring

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · oc-security-scan.sh (reported line 462)May include surrounding context.

sh

# OpenClaw paths (defaults, overridden by detection)
OC_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
OC_CONFIG="$OC_HOME/openclaw.json"
OC_SECRETS="$OC_HOME/secrets.env"
OC_WORKSPACE="$OC_HOME/workspace"

# Scoring

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · oc-security-scan.sh (reported line 443)May include surrounding context.

sh

# --- Scan for API keys in common files ---
    local sensitive_files=()
    for f in "$OC_HOME"/*.json "$OC_HOME"/*.env "$OC_HOME"/*.yaml "$OC_HOME"/*.yml "$OC_HOME"/*.toml; do
        [[ -f "$f" ]] && sensitive_files+=("$f")
    done

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · oc-security-scan.sh (reported line 462)May include surrounding context.

sh

local gitignore="$OC_WORKSPACE/.gitignore"
        if [[ -f "$gitignore" ]]; then
            local missing_patterns=()
            for pattern in "secrets.env" "*.env" ".env" "tokens" "*.key" "*.pem"; do
                if ! grep -qF "$pattern" "$gitignore" 2>/dev/null; then
                    missing_patterns+=("$pattern")
                fi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the user to execute a local shell script, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: a skill with shell-execution behavior can be invoked without clearly signaling its capabilities to users or enforcement layers, which is especially risky here because the skill also advertises an auto-fix mode that modifies the host system.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · oc-security-scan.sh (reported line 178)May include surrounding context.

sh

fi
}

# Utility: check if a file is world-readable
is_world_readable() {
    local perms
    perms="$(file_perms "$1")"

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · oc-security-scan.sh (reported line 237)May include surrounding context.

sh

fi
}

# Utility: check if a file is world-readable
is_world_readable() {
    local perms
    perms="$(file_perms "$1")"

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · oc-security-scan.sh (reported line 300)May include surrounding context.

sh

fi
}

# Utility: check if a file is world-readable
is_world_readable() {
    local perms
    perms="$(file_perms "$1")"

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · oc-security-scan.sh (reported line 325)May include surrounding context.

sh

fi
}

# Utility: check if a file is world-readable
is_world_readable() {
    local perms
    perms="$(file_perms "$1")"

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · oc-security-scan.sh (reported line 451)May include surrounding context.

sh

fi
}

# Utility: check if a file is world-readable
is_world_readable() {
    local perms
    perms="$(file_perms "$1")"

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · oc-security-scan.sh (reported line 487)May include surrounding context.

sh

fi
}

# Utility: check if a file is world-readable
is_world_readable() {
    local perms
    perms="$(file_perms "$1")"

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · oc-security-scan.sh (reported line 649)May include surrounding context.

sh

fi
}

# Utility: check if a file is world-readable
is_world_readable() {
    local perms
    perms="$(file_perms "$1")"

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · oc-security-scan.sh (reported line 660)May include surrounding context.

sh

fi
}

# Utility: check if a file is world-readable
is_world_readable() {
    local perms
    perms="$(file_perms "$1")"

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · oc-security-scan.sh (reported line 179)May include surrounding context.

sh

}

# Utility: check if a file is world-readable
is_world_readable() {
    local perms
    perms="$(file_perms "$1")"
    [[ -n "$perms" ]] && (( (8#$perms & 8#004) != 0 ))

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · oc-security-scan.sh (reported line 236)May include surrounding context.

sh

}

# Utility: check if a file is world-readable
is_world_readable() {
    local perms
    perms="$(file_perms "$1")"
    [[ -n "$perms" ]] && (( (8#$perms & 8#004) != 0 ))

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · oc-security-scan.sh (reported line 299)May include surrounding context.

sh

}

# Utility: check if a file is world-readable
is_world_readable() {
    local perms
    perms="$(file_perms "$1")"
    [[ -n "$perms" ]] && (( (8#$perms & 8#004) != 0 ))

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · oc-security-scan.sh (reported line 324)May include surrounding context.

sh

}

# Utility: check if a file is world-readable
is_world_readable() {
    local perms
    perms="$(file_perms "$1")"
    [[ -n "$perms" ]] && (( (8#$perms & 8#004) != 0 ))

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · oc-security-scan.sh (reported line 450)May include surrounding context.

sh

}

# Utility: check if a file is world-readable
is_world_readable() {
    local perms
    perms="$(file_perms "$1")"
    [[ -n "$perms" ]] && (( (8#$perms & 8#004) != 0 ))

Static analysis

No suspicious patterns detected.