ShieldClaw

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:38 AM UTC
• Version: 1.0.4

Overview

ShieldClaw is a plausible security skill, but it asks for broad filesystem, network, storage, and secret-handling authority while key security behavior is either unaudited or visibly incomplete.

Review carefully before installing. Do not rely on the advertised real-time protection or store real passwords, API keys, or private keys until the publisher provides auditable implementations, pinned dependencies or integrity metadata, narrower permissions, and clear documentation for logs, retention, key handling, secret display, and disabling Guard/Audit/Vault behavior.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: apps/openclaw-integration/dist/index.js:6

Finding

Unverifiable External Security Modules Create a Supply-Chain Trust Boundary

Content

View full analysis

Vulnerability Details

File Location: apps/openclaw-integration/dist/index.js:6-10
Vulnerability Type: Unpinned and unauditable runtime dependencies
Risk Level: High

Complete Code Snippet:

js

import { createCore, closeCore, } from '@shieldclaw/core';
import ScanPlugin from '@shieldclaw/scan';
import GuardPlugin from '@shieldclaw/guard';
import AuditPlugin from '@shieldclaw/audit';
import VaultPlugin from '@shieldclaw/vault';

The equivalent imports also appear in dist/index.js:4-8.

Technical Analysis

The integration delegates its principal security functionality to four external @shieldclaw/* packages. The audited artifact does not contain their implementations, a package manifest identifying exact versions, a lockfile, or integrity metadata.

These modules are loaded and activated during application initialization. They receive access to the ShieldClaw core, event bus, hook framework, notifications, dialogs, and command registration interfaces. Consequently, their actual filesystem, network, logging, encryption, and sensitive-data behavior cannot be validated from this artifact.

This is a supply-chain risk rather than proof that the named packages are malicious. Exploitation requires an attacker to compromise package distribution, influence module resolution, substitute a package, or publish a malicious package under a resolvable namespace.

Attack Path

1. An attacker compromises a dependency release, registry account, installation source, or local module-resolution path.
2. The application resolves one of the imported @shieldclaw/* modules to attacker-controlled code.
3. OpenClawApp.initialize() automatically loads and activates the substituted module.
4. The malicious module executes within the application process.
5. It abuses the granted storage, filesystem, or network capabilities to access or transmit data, modify security decisions, or interfere with audit record ...[truncated 403 chars]

Remediation

View remediation

Remediation Suggestions

• Include a package manifest and lockfile with exact dependency versions.
• Enforce package integrity hashes and verified registry provenance during installation.
• Bundle or publish auditable source for all @shieldclaw/* runtime modules.
• Generate and distribute an SBOM covering direct and transitive dependencies.
• Use trusted publishing, signed releases, protected package-owner accounts, and reproducible builds.
• Prevent loading dependencies from uncontrolled search paths.
• Give each plugin only the specific capabilities required for its function instead of sharing a broadly privileged core interface.
• Add automated dependency scanning and review dependency changes before release.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: clawhub.json:27

Finding

Unnecessary Network Permission Expands the Impact of Filesystem Access

Content

View full analysis

Vulnerability Details

File Location: clawhub.json:27-31
Vulnerability Type: Excessive and insufficiently scoped permissions
Risk Level: Medium

Complete Code Snippet:

json

"permissions": [
  "storage",
  "network",
  "filesystem"
],

Technical Analysis

Storage and filesystem access are consistent with local audit storage, explicit Skill scanning, and Vault functionality. However, the reviewed integration contains no outbound network request, while the documentation states that data is stored locally. An unrestricted network permission is therefore not justified by the visible implementation.

The combination of filesystem and network access is especially sensitive because it creates a potential read-and-exfiltrate capability. This risk is amplified by the unaudited external plugins activated at runtime. Network-operation interception does not inherently require permission to initiate unrestricted outbound connections, so interception requirements should be distinguished from egress privileges.

Attack Path

1. A malicious or compromised runtime plugin is activated during initialization.
2. The plugin uses filesystem permission to access application data or other files available to the OpenClaw process.
3. It uses the unnecessary network permission to establish an outbound connection.
4. Read data is transmitted to an attacker-controlled endpoint.
5. Broad permission scope reduces the ability of the host platform to prevent or contain the operation.

Impact Assessment

Abuse could expose files readable by the OpenClaw process, including scan targets, local audit information, configuration data, or sensitive information submitted to security features. It could also allow outbound telemetry or exfiltration not disclosed by the visible code. This finding does not establish that exfiltration currently occurs; it identifies an avoidable capability that increases the consequences of d ...[truncated 21 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the network permission unless a documented feature demonstrably requires outbound access.
• If network access is required, restrict it to explicit destinations, protocols, ports, and request types.
• Separate network interception privileges from privileges that permit initiating outbound connections.
• Restrict filesystem access to user-selected scan targets, the ShieldClaw application-data directory, and explicitly configured protected paths.
• Require informed user approval before expanding protected or scanned path scope.
• Apply capability separation so Scan, Guard, Audit, and Vault receive only their individual minimum permissions.
• Document every requested permission, its purpose, and whether data can leave the local system.

T09 · Insecure Skill Coding Practices

Error

• Location: apps/openclaw-integration/dist/index.js:72

Finding

Guard Hook Initialization Is a No-Op and Leaves Protection Fail-Open

Content

View full analysis

Vulnerability Details

File Location: apps/openclaw-integration/dist/index.js:72-74
Vulnerability Type: Missing enforcement for an advertised security control
Risk Level: High

Complete Code Snippet:

js

initHooks() {
    this.core.logger.info('[HookFramework] Hooks initialized');
}

The equivalent implementation appears in dist/index.js:33-36, where a comment explicitly identifies filesystem, network, and process hooks as a pending task. In addition, apps/openclaw-integration/dist/index.js:151-153 records command names but discards their handlers:

js

registerCommand(command, _handler) {
    console.log(`[OpenClaw] Command registered: ${command}`);
}

Technical Analysis

The Skill advertises real-time filesystem, network, and process protection. However, initHooks() does not install any interception mechanism and still logs that hooks were initialized. Rule evaluation only occurs if another component explicitly calls evaluate(ctx); the visible integration does not connect that method to system operations.

The command adapter also ignores the supplied handler, meaning plugin commands are announced but are not connected to executable behavior through this implementation. Together, these no-op adapters can cause the application to report successful security initialization without establishing the promised enforcement path.

This is a fail-open security-control flaw. It does not itself grant an attacker new operating-system privileges, but it allows actions that users reasonably expect Guard to intercept to proceed without evaluation.

Attack Path

1. A user enables Guard or relies on its default enabled state.
2. Initialization calls initHooks() and logs that hooks were initialized.
3. No filesystem, network, or process interceptor is installed.
4. An attacker-controlled component or ordinary process accesses a configured sensitive path or performs another suspicio ...[truncated 701 chars]

Remediation

View remediation

Remediation Suggestions

• Implement actual filesystem, network, and process interception before reporting successful Guard initialization.
• Ensure every relevant operation is synchronously evaluated before execution.
• Fail closed, or clearly disable Guard, when required interception facilities cannot be installed.
• Add startup self-tests that verify hooks are active and capable of blocking a harmless test operation.
• Connect registered command handlers to the OpenClaw command-dispatch system instead of discarding them.
• Expose an explicit health state distinguishing active, degraded, unsupported, and disabled protection.
• Add integration tests proving that access to configured sensitive paths triggers the expected block or alert action.
• Avoid claiming that a security control is initialized until its enforcement path has been validated.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill claims strong security functions such as encryption, audit logging, and real-time protection, but the described behavior is not substantiated in the file and appears broader or different than evidenced. In a security product, overstating protections is dangerous because users may entrust secrets or rely on safeguards that do not actually exist, creating a false sense of security.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Guard feature describes monitoring and intercepting file, network, and process activity but does not prominently warn users that these operations can observe or block sensitive behavior. In context, this is especially dangerous because a security-branded skill may be trusted more readily, causing users to enable invasive monitoring without understanding privacy and operational implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Vault section invites users to store passwords, API keys, and private keys and to view saved sensitive data, but it lacks strong warnings about secret retention, disclosure risks, and recovery limitations. This is high impact because users may provide highly sensitive credentials under the assumption of robust protection without being told storage boundaries, access controls, export behavior, or failure modes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The README instructs users to run npx clawhub@latest install shieldclaw, which executes code from a moving latest tag rather than a pinned version. That increases supply-chain risk because a compromised or malicious future release of clawhub would be executed during installation, and this is especially concerning in a security-focused skill where users are likely to grant elevated trust.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README states that audit logs and configuration are stored locally, but it does not clearly warn users that potentially sensitive security events and metadata may be retained on disk for extended periods. In a security tool, audit logs can contain file paths, operational history, and other sensitive traces, so weak disclosure increases privacy and data exposure risk if the host is shared or compromised.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence

Finding

The skill advertises security-sensitive capabilities yet declares no explicit tool scope or permissions boundary. For a security skill, undeclared environment access increases ambiguity around what data may be read or acted upon, which can lead to over-privileged execution or unsafe assumptions by users and the host system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation language is overly broad for a high-risk security skill, making it more likely to trigger for generic security-related requests without sufficient user intent confirmation. Because the skill includes scanning, monitoring, and secret-handling themes, broad routing can expose users to unexpected collection, inspection, or operational side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Audit feature records operation logs and supports exporting security logs, but the description omits notice that logs may contain sensitive operational details. Without warning, users may unknowingly generate long-lived records of commands, paths, events, or potentially secret-adjacent information, increasing privacy and leakage risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file states that ShieldClaw automatically creates configuration files in user-specific locations, which affects the local filesystem. While the behavior is documented, it is presented as an implementation detail rather than a user-facing warning or caution about automatic writes to disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code automatically determines a user-specific data directory, creates it if needed, and initializes persistent database and log storage under that location. Although there are developer comments and logger messages, there is no clear user-facing warning before writing files to disk in a user profile location.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description is written only in Chinese ("OpenClaw 安全技能套件...") with no indication that users can choose another language or locale. This creates a natural-language policy concern because the skill presents itself in a single language without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file’s user-facing/descriptive natural-language comments are written exclusively in Chinese, and there is no indication that users can choose another language or that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.