Openclaw Shield 1.0.3

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:36 AM UTC
• Version: 1.0.0

Overview

The skill is a security-scanner wrapper, but it tells users to clone and run an unpinned external repository and optionally schedule recurring execution outside the reviewed package.

Review the external repository source and pin it to a trusted commit before running it. Avoid enabling the cron job or runtime guard until the exact scripts, permissions, alerting destinations, and disable/removal steps are documented and acceptable for your environment.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:34
• Finding: Unpinned Remote Repository Is Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 34–38 **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: Critical ```bash cd /home/node/.openclaw/workspace git clone https://github.com/pfaria32/OpenClaw-Shield-Security.git projects/OpenClaw-Shield # Test the scanner python3 projects/OpenClaw-Shield/src/scanner.py /path/to/scan ``` ### Technical Analysis The installation instructions clone the current default branch of an external GitHub repository and then execute its `src/scanner.py` file. No immutable commit hash, release signature, checksum, or other integrity verification is specified. The executable scanner source is not included in the audited artifact, which contains only documentation and metadata. Consequently, the effective payload cannot be reviewed as part of this package and may change after the Skill has been approved. A repository maintainer, compromised maintainer account, or attacker controlling the upstream repository could replace the scanner with arbitrary code. This behavior also contradicts the package's claim of “zero supply chain risk.” While using an external repository is not by itself proof that its current contents are malicious, downloading mutable code and immediately executing it establishes an unaudited remote code-execution channel. ### Attack Path 1. An agent or operator follows the installation instructions in `SKILL.md`. 2. `git clone` retrieves the external repository's current default branch. 3. The repository contents differ from those previously reviewed, either through a legitimate update or upstream compromise. 4. The operator executes the downloaded `src/scanner.py`. 5. Attacker-controlled Python code runs with the permissions and environmental access of the invoking account. ### Impact Assessment Successful exploitation provides arbitrary code execution under the invoking user's privileges. Depending on the environm ...[truncated 422 chars]
• Remediation: ## Remediation Suggestions - Include the complete scanner implementation in the Skill package so its executable behavior is covered by the same security review. - If external retrieval is unavoidable, pin the repository to a specific audited commit rather than using its mutable default branch. - Verify a documented cryptographic checksum or trusted release signature before executing any downloaded file. - Require explicit user approval after retrieval and before execution. - Review and document the scanner's required filesystem, process, and network permissions. - Run the scanner in a restricted environment with read-only access to scan targets, no unnecessary credentials, and network access disabled unless explicitly required. - Establish a controlled update process in which each new upstream version is reviewed and assigned a new verified hash.

T06 · System Persistence

Warning

• Location: SKILL.md:48
• Finding: Documentation Encourages Persistent Scheduled Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 48–52 **Vulnerability Type**: Recurring scheduled-task deployment **Risk Level**: Medium ```markdown ### Daily Automated Scans Set up cron job (see repository deployment guide): ```bash # Daily at 3 AM UTC 0 3 * * * /path/to/scan-script.sh ``` ### Technical Analysis The Skill recommends configuring a cron job that persists beyond the current Skill invocation and executes a script every day. Recurring security scans are consistent with the declared scanner functionality, but scheduled execution expands the trust boundary from a one-time manual operation to an ongoing system-level behavior. The referenced `/path/to/scan-script.sh` is not included in the audited artifact. Its commands, ownership, integrity protections, and permissions therefore cannot be assessed. When combined with the unpinned external implementation described above, recurring execution may repeatedly run code whose contents were not reviewed with this package. The snippet is documentation and does not itself install a cron entry. Exploitation requires an operator or agent to follow the deployment instruction. ### Attack Path 1. An operator installs the external scanner and follows the daily-scan recommendation. 2. A cron entry is configured to invoke `scan-script.sh`. 3. The script or the scanner it invokes is replaced, modified, or updated from an untrusted mutable source. 4. Cron executes the modified payload automatically at the scheduled time. 5. The payload runs repeatedly under the privileges of the account that owns the cron entry. ### Impact Assessment The scheduled task creates cross-session persistence and recurring execution. If the referenced script or scanner is compromised, attacker-controlled code may execute daily without further user interaction. The obtainable privileges are limited to those of the cron owner. If configured under a privileged account, the impact ...[truncated 184 chars]
• Remediation: ## Remediation Suggestions - Do not create scheduled tasks automatically; require explicit administrator approval. - Ship and audit the exact scan script rather than referring to an unspecified external file. - Pin and integrity-check every executable component used by the scheduled task. - Run the cron job under a dedicated, least-privileged service account. - Restrict filesystem access to the directories that must be scanned and disable unnecessary network access. - Use absolute paths, restrictive file ownership, and non-writable executable directories to prevent script replacement. - Document how to inspect, disable, and remove the scheduled task. - Record scanner version and integrity information in audit logs for every scheduled execution.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The listed triggers include generic phrases like "security scanning" and "code auditing," which are broad enough to overlap with many routine user requests. The description does not provide explicit constraints, trigger examples, or exclusion cases that clarify when this skill should or should not be invoked.

Static analysis

No suspicious patterns detected.