ShellWard Security Guide

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:43 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent OpenClaw security checklist, but it asks agents to inspect broad credential-bearing files and suggests an unsafe blanket SSH permission command.

Review before installing. The skill may be useful for OpenClaw hardening, but do not let it print or retain secret values, and limit any credential scan to OpenClaw-specific paths with redacted output. Avoid the blanket `~/.ssh/*` chmod command; inspect paths individually and only change permissions after confirming the exact affected files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:32

Finding

Overbroad Inspection of Plaintext Secrets and Environment Variables

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 32
Vulnerability Type: Excessive access to credential-bearing data
Risk Level: Medium

Complete Code Snippet:

markdown

- Scan for plaintext secrets in .env, .bashrc, environment variables

Technical Analysis

The instruction directs the agent to scan .env, .bashrc, and environment variables for plaintext secrets. These sources can contain API keys, passwords, access tokens, cloud credentials, and credentials belonging to applications unrelated to OpenClaw.

The instruction does not constrain the scan to OpenClaw-specific paths or variable names. It also does not require explicit user consent, local-only matching, redaction, or suppression of secret values in responses and logs. Consequently, secret values may unnecessarily enter the agent's context even though the declared security-deployment function can generally be fulfilled by checking file existence, ownership, permissions, secret naming patterns, and configuration practices without retrieving complete values.

This violates least-privilege and data-minimization principles. The audited file does not specify a remote destination or explicitly instruct the agent to exfiltrate the collected data.

Attack Path

1. A user invokes the security-guide Skill.
2. The agent follows the instruction to inspect .env, .bashrc, and all available environment variables.
3. The inspected sources contain unrelated credentials or authentication tokens.
4. Complete secret values enter the agent context.
5. Those values may be disclosed in generated output, tool traces, audit logs, or other retained execution records if the implementation does not independently redact them.

Impact Assessment

Successful exposure could compromise any account, API, cloud resource, or service associated with the inspected credentials. The scope depends on the permissions assigned to each exposed secret and may e ...[truncated 249 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict checks to documented OpenClaw configuration files and OpenClaw-specific environment-variable names.

• Check file metadata, ownership, and permissions without reading file contents whenever possible.

• Require explicit user authorization before inspecting any credential-bearing content.

• Detect likely secrets locally and report only the source, variable name, secret type, and a fully redacted fingerprint.

• Prohibit printing, logging, storing, or transmitting complete secret values.

• Add explicit exclusions for unrelated shell configuration, cloud credentials, and application environments.

• Replace the instruction with a constrained form such as:

  markdown

  Check permissions and ownership of OpenClaw credential files without displaying
  their contents. With explicit user consent, scan only documented OpenClaw
  configuration paths for likely secrets and return redacted findings.
  

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34

Finding

Unsafe Blanket Permission Change Across SSH Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34-35
Vulnerability Type: Overbroad and potentially destructive filesystem permission command
Risk Level: Medium

Complete Code Snippet:

markdown

- Check file permissions on sensitive files (should be 0600)
- Suggest `chmod 600 ~/.env ~/.ssh/* ~/.aws/credentials`

Technical Analysis

The suggested command applies mode 0600 indiscriminately to every entry matched by ~/.ssh/*. That wildcard can include private keys, public keys, known_hosts, SSH configuration files, sockets, and subdirectories.

Applying 0600 to a directory removes its execute permission. Without execute permission, the directory cannot be traversed, which can make files beneath it inaccessible. The command also treats resources with different permission requirements as though they were all private key files. Public keys, directories, and other SSH artifacts do not necessarily require mode 0600.

The command may partially modify the system before failing when optional paths such as ~/.env or ~/.aws/credentials are absent. Although the Skill says to ask for confirmation before destructive operations, it presents this blanket command as the exact remediation and does not require file-type validation, path validation, or a preview of affected entries.

Attack Path

1. The Skill is invoked during a security review.
2. The agent identifies permissions that it considers noncompliant.
3. The user or agent runs chmod 600 ~/.env ~/.ssh/* ~/.aws/credentials.
4. The wildcard matches an SSH subdirectory or another entry that requires different permissions.
5. The permission change removes required directory traversal or otherwise disrupts SSH-related operation.
6. On a remotely administered host, the disruption may prevent subsequent SSH access or complicate recovery.

Impact Assessment

The command operates with the invoking user's authority and can alter all ...[truncated 412 chars]

Remediation

View remediation

Remediation Suggestions

• Enumerate each target and determine its file type before changing permissions.

• Set the SSH directory itself to mode 0700:

  sh

  chmod 700 "$HOME/.ssh"
  

• Apply mode 0600 only to confirmed private keys and sensitive SSH configuration files.

• Do not use an unrestricted ~/.ssh/* wildcard.

• Preserve appropriate permissions for public keys and other non-secret files.

• Validate that optional paths exist before changing them.

• Display the exact affected paths and obtain explicit confirmation before execution.

• Back up current permission metadata or provide a rollback procedure.

• Prefer a conditional hardening routine that handles directories and regular files separately rather than one blanket command.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

- Scan for plaintext secrets in .env, .bashrc, environment variables
- Recommend using a secret manager (Vault, doppler, etc.)
- Check file permissions on sensitive files (should be 0600)
- Suggest `chmod 600 ~/.env ~/.ssh/* ~/.aws/credentials`

### 4. Audit Logging / 审计日志
- Verify ShellWard audit log is active at ~/.openclaw/shellward/audit.jsonl

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

- Scan for plaintext secrets in .env, .bashrc, environment variables
- Recommend using a secret manager (Vault, doppler, etc.)
- Check file permissions on sensitive files (should be 0600)
- Suggest `chmod 600 ~/.env ~/.ssh/* ~/.aws/credentials`

### 4. Audit Logging / 审计日志
- Verify ShellWard audit log is active at ~/.openclaw/shellward/audit.jsonl

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The skill recommends running openclaw without a pinned image tag or digest, which makes deployments non-reproducible and can silently pull a changed or compromised image later. In a security hardening guide, this is especially problematic because users may assume the example is a secure baseline and copy it directly.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

- Scan for plaintext secrets in .env, .bashrc, environment variables
- Recommend using a secret manager (Vault, doppler, etc.)
- Check file permissions on sensitive files (should be 0600)
- Suggest `chmod 600 ~/.env ~/.ssh/* ~/.aws/credentials`

### 4. Audit Logging / 审计日志
- Verify ShellWard audit log is active at ~/.openclaw/shellward/audit.jsonl

Static analysis

No suspicious patterns detected.