Config Guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:49 AM UTC
• Version: 1.0.0

Overview

This skill is intended to help edit OpenClaw configuration, but its advertised redaction is broken and can expose API keys or tokens while claiming the output is safe.

Review carefully before installing. Do not share output from this skill's preview or sanitize scripts, and assume any credentials processed by the current redaction commands may be exposed in terminal output or logs. The edit workflow should use structural jq-based redaction, a minimal non-sensitive diff, a secure temporary file in the config directory, and clear user confirmation before modifying or restarting OpenClaw.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/preview.sh:10

Finding

Configuration Preview Fails to Redact API Keys, Tokens, Passwords, and Secrets

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sanitize.sh:5

Finding

Standalone Sanitizer Does Not Redact Most Advertised Sensitive Fields

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:77

Finding

Predictable Temporary File Enables Symlink-Based File Overwrite

Content

View full analysis

/tmp/openclaw.json mv /tmp/openclaw.json ~/.openclaw/openclaw.json ``` ### Technical Analysis The documented modification procedure writes sensitive configuration data to the fixed path `/tmp/openclaw.json`. Shared temporary directories are normally writable by other local users. Although the sticky bit commonly prevents one user from deleting another user's files, it does not prevent a victim process from following a symbolic link created at a predictable path. Shell redirection opens `/tmp/openclaw.json` before `jq` runs and follows symbolic links by default. A local attacker can therefore create `/tmp/openclaw.json` as a symbolic link to another file writable by the victim. When the victim or an agent follows the documented procedure, the redirection truncates and overwrites the link target with generated JSON. The subsequent `mv` can also replace the original configuration with the attacker-created symbolic link, producing corruption, an unexpected linked configuration, or denial of service. The fixed name additionally permits collisions between concurrent invocations. This issue appears in an instruction file rather than an included executable script, but the skill explicitly directs the agent or user to execute the vulnerable command sequence. ### Attack Path 1. An attacker has access to the same host as an unprivileged local user and can write to `/tmp`. 2. Before the victim performs a configuration update, the attacker creates a predictable symbolic link: ```bash ln -s /path/to/a/file/writable/by/the/victim /tmp/openclaw.json ``` 3. The victim or agent follows the procedure in ` ...[truncated 1235 chars]

Remediation

View remediation

"$tmp" jq empty "$tmp" chmod --reference="$config" "$tmp" mv -f -- "$tmp" "$config" trap - EXIT ``` The hardening plan should also include: 1. Use `mktemp`; never use a fixed filename in `/tmp`. 2. Prefer placing the temporary file in the same directory as the destination so the final rename remains atomic and does not cross filesystems. 3. Enable `set -euo pipefail` so failed generation or validation cannot continue to replacement. 4. Validate the temporary JSON before replacing the active configuration. 5. Preserve or explicitly restrict permissions, such as mode `0600`, because the file may contain credentials. 6. Install a cleanup trap to remove temporary files on failure or interruption. 7. Use `--` before path arguments to prevent option parsing. 8. Retain the backup procedure, but verify backup creation succeeded before modifying the active file. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的核心能力是“安全修改”配置文件，且强调修改前备份、脱敏预览、并获得用户确认。但实际代码是一个 preview.sh 预览脚本，只读取配置文件并输出部分字段和完整配置的脱敏版本，没有任何写入、备份、差异预览后的确认交互或应用修改逻辑。因此其实际行为只覆盖了声明中的一个辅助环节（预览/部分脱敏），与声明的主要用途存在实质不符。虽然代码没有表现出额外越权或危险能力，但其主功能明显弱于且不同于声明的完整安全修改流程。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a full safe configuration-editing skill for OpenClaw, with file modification, backup, preview, and user confirmation. The supplied code only implements one narrow supporting function: masking sensitive values in JSON streamed through stdin. That behavior is related to the declared preview/redaction aspect, but it does not fulfill the primary declared purpose of safely modifying the OpenClaw config file. Because the actual code’s primary behavior is materially narrower and different from the declared end-to-end modification workflow, this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的核心能力是“安全修改配置文件”，并明确包含修改、备份、预览和确认等流程。但提供的代码仅做静态校验和信息输出，属于配置验证工具，而不是配置修改工具。其主要目的与声明明显不一致，且缺少声明中强调的关键安全修改步骤，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description is written as an unconditional Chinese-language instruction, and the confirmation flow later requires a Chinese-only exact phrase. This imposes a language constraint on all users without documenting an opt-in or offering an alternative locale, which matches the policy's language/locale violation criterion.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The documented connectivity test sends a network request to an external service, which creates outbound transmission from a skill intended for local configuration handling. Even though the example uses a test bearer token, invoking external requests during validation can leak metadata such as IP, timing, environment usage patterns, or accidentally real credentials if operators adapt the command unsafely.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

~/.openclaw/skills/safe-config/scripts/validate.sh

测试 API 连通性（如适用）

curl -s https://api.siliconflow.cn/v1/models -H "Authorization: Bearer test" | jq .

text

### 步骤 3: 请求用户确认

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Requiring a single exact Chinese phrase for confirmation creates a brittle confirmation control that can cause operators to bypass or mis-handle approval steps, especially in multilingual environments. A safety-critical confirmation mechanism should be unambiguous and accessible; otherwise users may resort to ad hoc workarounds that weaken the intended authorization check.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

"models": {
    "providers": {
      "anthropic": {
        "baseUrl": "https://api.anthropic.com/v1",
        "apiKey": "sk-ant-***",
        "models": [
          {

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The user-facing natural-language fields are written entirely in Chinese, including the required confirmation phrase, with no indication that another language is supported or that the skill is region-specific. This creates a language/locale policy issue because it imposes a specific language on users without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all instructions and examples in Chinese only, with no indication that the user can choose another language. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's comments, usage text, and terminal output are written entirely in Chinese, which forces a specific language for users regardless of locale. The policy allows fixed-language behavior only when users are given a choice or the locale restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script prints broad portions of a user’s OpenClaw configuration, including metadata, provider names, channel/plugin state, and a full JSON dump after only partial redaction. The redaction logic is incomplete and brittle, so secrets under other key names or nested formats may still be exposed to the terminal, logs, scrollback, or screen sharing; in the context of a skill specifically intended to inspect and modify ~/.openclaw/openclaw.json, this increases the likelihood of sensitive disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This shell script uses Chinese-only comments and user-facing messages throughout, such as the usage text and validation results. For a general-purpose validation skill, forcing a specific language without opt-in or a documented region-specific justification is a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.