Security audit

OpenClaw Safety Guard

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small wrapper for a documented safety-guard CLI, with normal but privacy-relevant use of external AI providers and a third-party Homebrew install source.

Install only if you trust the safety-guard Homebrew tap and are comfortable sending selected URLs, files, and YouTube content to your configured AI provider or optional extraction services. Avoid running it on private, regulated, or confidential material unless those providers and tokens are approved for that data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:5
Finding: Unpinned Third-Party Homebrew Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Unpinned dependency from a third-party Homebrew tap **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["safety-guard"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/safety-guard","bins":["safety-guard"],"label":"Install safety-guard (brew)"}]}} ``` ### Technical Analysis The Skill instructs its environment to install `safety-guard` from the third-party Homebrew tap `steipete/tap`. The dependency is not constrained to a reviewed version, immutable commit, checksum, or cryptographic signature. Consequently, the package resolved at installation time may differ from the package that existed when the Skill was audited. A compromise of the tap, its maintainer account, the formula, or an upstream binary distribution could introduce attacker-controlled installation or runtime behavior. Homebrew formulas can execute installation logic and place executables on the user's command path, making this a supply-chain trust boundary. The project contains no local executable scripts, and the reviewed files provide no evidence that the dependency is currently malicious. The risk arises from the mutable and externally controlled installation source. ### Attack Path 1. An attacker compromises the third-party Homebrew tap, its maintainer account, or an upstream artifact referenced by its formula. 2. The attacker modifies the formula or distributed package to include malicious installation or runtime behavior. 3. A user or agent loads the Skill and follows its installation metadata to install `steipete/tap/safety-guard`. 4. Homebrew retrieves the mutable formula and associated artifacts from the compromised source. 5. Attacker-controlled code executes during installation or when the Skill later invokes the installed `safety-guard` binary. ### Impact Assessment Malicious formula installation logic or a compro ...[truncated 678 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed, immutable release or repository commit rather than a mutable formula reference. 2. Verify downloaded artifacts using published cryptographic checksums or signatures before installation. 3. Prefer an official, trusted package repository where available instead of a third-party tap. 4. Document the exact source repository, release version, and expected artifact digest so future audits can reproduce dependency verification. 5. Use a locked installation mechanism that rejects unexpected formula or artifact changes. 6. Run installation and execution with least privilege and avoid `sudo`. 7. Isolate the CLI in a sandbox or container with narrowly scoped filesystem and network access. 8. Provide API credentials only when required, and avoid exposing unrelated credentials to the CLI process. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs users to submit URLs, local files, and YouTube links to a CLI that relies on external model providers and optional fallback services, but it does not clearly warn that submitted content may be transmitted off-device. This can lead users to unknowingly send sensitive documents, private URLs, or regulated data to third-party AI/extraction services, creating confidentiality and compliance risk.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The provided manifest context describes this skill as 'safety-guard' for guarding URLs or files with the safety-guard CLI, but the file metadata uses the slug 'summarize'. This indicates a likely description/behavior identity mismatch at the skill packaging level, suggesting the artifact may not correspond to the stated skill purpose.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The documentation lists provider API key environment variables and optional third-party service tokens, but does not pair them with a warning that these credentials enable access to external services and may cause user content to be transmitted externally. While merely naming env vars is common, in this context it increases the chance that users configure remote services without understanding the privacy and access implications.

Static analysis

No suspicious patterns detected.