ClawHub
Back to skill

Security audit

Safe Config Modifier

Security checks for vulnerabilities and agentic risk

Overview

The skill is not visibly malicious, but its safety workflow for editing OpenClaw configuration can expose secrets and uses an unsafe temporary-file pattern.

Review before installing. This skill deals with persistent OpenClaw configuration and possible API keys, so do not rely on its redacted preview as written. Avoid sharing its preview output, do not use the documented /tmp/openclaw.json replacement pattern for real credentials, and require a safer implementation using structural JSON redaction and secure same-directory temporary files before using it for sensitive configs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/preview.sh:13
Finding

Sensitive configuration values are exposed because redaction patterns are ineffective

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:80
Finding

Predictable shared temporary file permits configuration disclosure and local file attacks

Content
View full analysis
/tmp/openclaw.json mv /tmp/openclaw.json ~/.openclaw/openclaw.json ``` ### Technical Analysis The documented configuration-modification workflow writes the complete configuration to the fixed path `/tmp/openclaw.json`. `/tmp` is normally shared among local users, and the predictable filename enables race conditions and symbolic-link attacks. The shell opens the destination before `jq` runs. If another local user creates `/tmp/openclaw.json` as a symbolic link to a file writable by the victim, the redirection can follow that link and truncate or overwrite the target with the victim's privileges. The subsequent `mv` may then replace the configuration path with the prepared temporary object or symbolic link. When the path does not already exist, the temporary file is created according to the user's `umask`. Under common settings, it may be readable by other local users during the interval before `mv`, exposing the entire configuration. Moving a newly created file can also change expected ownership, mode, access-control entries, or other metadata associated with the original configuration. ### Attack Path 1. A local attacker predicts that the victim will follow the documented modification procedure. 2. Before the redirection occurs, the attacker creates `/tmp/openclaw.json` as a symbolic link to a victim-writable target, or continuously races to replace the predictable path. 3. The victim executes the documented `jq` command. 4. Shell redirection follows or writes through the attacker-controlled path with the victim's permissions. 5. The target file may be truncated or overwritten, and the subsequent `mv` can install attacker-influenced content or a symbolic link as `~/.openclaw/openclaw.json`. A confidentiality variant i ...[truncated 1058 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明描述的是一个“安全修改配置文件”的技能，核心能力应包括修改 ~/.openclaw/openclaw.json，并在修改前进行备份、脱敏预览以及用户确认。但提供的代码只是一个 preview.sh 脚本，用于读取指定配置文件并输出部分字段与脱敏后的完整内容。它没有写入文件、创建备份、提示确认或执行任何配置变更，因此其实际主要目的与声明不符。虽然“预览（脱敏 key）”这一点与声明部分一致，但只覆盖了声明中的一个辅助环节，不能代表整体技能目的，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

声明的核心能力是“安全修改 OpenClaw 配置文件”，并明确包括修改配置、备份、预览和确认等完整流程。但实际代码仅是一个独立的脱敏脚本：从标准输入读取文本并对特定键名的值做掩码替换。它没有文件定位、配置编辑、备份、写回、模型切换、tools/channel/skill 配置等行为。虽然“脱敏预览”与声明中的一个支持性环节一致，但代码的主要行为远小于且不同于声明的主要目的，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明的核心用途是“安全修改” OpenClaw 配置文件，并明确包含修改前备份、预览和确认等保护步骤。但提供的代码块只是 validate.sh 验证脚本，功能集中在读取并检查配置文件内容是否存在、JSON 是否合法、字段是否存在，以及输出部分配置信息。其主要目的与声明明显不同，且缺失声明中关键的修改与安全控制流程，因此属于明显的描述与行为不一致。

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The skill instructs operators to perform an external network request to a third-party API endpoint during validation. Even with a placeholder bearer token, outbound connectivity can leak metadata such as IP, environment usage patterns, and the fact that this provider is being tested; in stricter environments, any unsolicited external transmission is sensitive and may violate policy.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

~/.openclaw/skills/safe-config/scripts/validate.sh

测试 API 连通性（如适用）

curl -s https://api.siliconflow.cn/v1/models -H "Authorization: Bearer test" | jq .

text

### 步骤 3: 请求用户确认

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions require a single Chinese confirmation phrase, "ojbk可以改了", and explicitly reject other confirmations. This imposes a specific language/locale requirement on users without opt-in or documented justification, which matches the language policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
"models": {
    "providers": {
      "anthropic": {
        "baseUrl": "https://api.anthropic.com/v1",
        "apiKey": "sk-ant-***",
        "models": [
          {

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file presents all instructions and examples only in Chinese, which can constitute a language/locale policy violation when no user opt-in or alternative language option is provided. The file does not indicate that the content is intentionally limited to a Chinese-speaking audience or region-specific use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Comments and terminal output strings are written exclusively in Chinese, and the script provides no language selection or documented locale constraint. This can violate language/locale policy when a skill forces one language for all users without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The user-facing description and features are entirely in Chinese, including a required confirmation phrase, with no indication that other languages are supported or optional. This creates a locale/language constraint that is not documented as optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This code file previews the contents of a user config file and prints multiple fields plus a sanitized full JSON document. Although some secrets are masked, the usage/comment text does not warn users that configuration details such as models, channels, plugins, and timestamps will be exposed in terminal output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This shell script presents its comments and user-facing messages entirely in Chinese, including usage guidance and validation results. That can violate a language/locale policy when users are not given a choice of language and the file is not clearly documented as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.