AgentOps — Agent运维管理

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:51 AM UTC
• Version: 1.0.0

Overview

This skill is an OpenClaw operations toolkit whose local checks, log/config reads, and small user-directed writes fit its stated admin purpose.

Install only if you are comfortable with a local ops tool reading OpenClaw logs, config, workspace metadata, process lists, and system metrics. Review generated reports before sharing them, be careful with gateway restart or log cleanup advice, and note that alert rules and report files are written only when you invoke those actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (32)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises or implies capabilities that would require file read, file write, and shell access through the referenced scripts, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization and review gap: operators and policy systems cannot clearly constrain what the skill may access, increasing the risk of over-privileged execution or unintended access to host files and commands.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file uses Chinese throughout the title, descriptions, and checklist, which effectively forces a specific language on readers. The policy allows fixed locale behavior only when the skill offers opt-in language choice or clearly documents a justified regional constraint, neither of which appears here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The troubleshooting guide instructs operators to restart the gateway without warning that this can interrupt active sessions or temporarily disrupt service. In an ops-focused skill, users may copy commands directly, so omitting disruption cautions increases the chance of accidental downtime during diagnosis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quick-fix advice tells users to clean old logs without warning that log deletion is irreversible and may remove evidence needed for incident response, auditing, or root-cause analysis. Because this is an operations/troubleshooting document, readers are especially likely to perform the action immediately, making the omission more dangerous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains its primary docstring, CLI help text, and status/output messages entirely in Chinese, which imposes a fixed language on users. The file does not provide any language-selection option or explain that the tool is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This Python file contains user-facing descriptions, help text, errors, and report output entirely in Chinese, with no option to select another language or detect user locale. That creates a natural-language policy concern under the locale/language rule because the skill imposes a specific language rather than offering user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file contains user-facing natural-language usage text entirely in Chinese, and additional CLI descriptions throughout the file are also Chinese-only. The policy allows locale constraints only when the skill offers user opt-in or clearly documents a justified region/language limitation, which is not present here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnostic.py (reported line 265)May include surrounding context.

python

elif issue_key == "connection_error":
        # 检查网络连接
        try:
            result = subprocess.run(
                ["ping", "-c", "1", "-W", "3", "8.8.8.8"],
                capture_output=True, text=True, timeout=10
            )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnostic.py (reported line 68)May include surrounding context.

python

# 检查 gateway 进程
    try:
        result = subprocess.run(
            ["pgrep", "-f", "openclaw"],
            capture_output=True, text=True, timeout=5
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/health_check.py (reported line 24)May include surrounding context.

python

# 检查 gateway 进程
    try:
        result = subprocess.run(
            ["pgrep", "-f", "openclaw"],
            capture_output=True, text=True, timeout=5
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/perf_report.py (reported line 168)May include surrounding context.

python

# 检查 gateway 进程
    try:
        result = subprocess.run(
            ["pgrep", "-f", "openclaw"],
            capture_output=True, text=True, timeout=5
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/health_check.py (reported line 38)May include surrounding context.

python

# 检查 gateway 端口
    try:
        result = subprocess.run(
            ["ss", "-tlnp"],
            capture_output=True, text=True, timeout=5
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnostic.py (reported line 82)May include surrounding context.

python

# 检查 Node.js 可用性
    try:
        result = subprocess.run(
            ["node", "--version"],
            capture_output=True, text=True, timeout=5
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/health_check.py (reported line 55)May include surrounding context.

python

# 检查 Node.js 可用性
    try:
        result = subprocess.run(
            ["node", "--version"],
            capture_output=True, text=True, timeout=5
        )

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file contains natural-language user-facing documentation and output text entirely in Chinese, including the module docstring and command help text. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is documented and justified, which it is not here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring and CLI help claim support for --since and --until, suggesting date-bounded log analysis. However, analyze_log never uses its since or until parameters when reading or filtering entries, so the documented behavior is not implemented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User-facing report headings, error messages, hints, argparse descriptions, and status text are emitted only in Chinese. The policy allows locale constraints only when justified or optional, but this file provides neither a locale choice nor justification for restricting all interactions to Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language strings that force a specific language for usage instructions and user interaction. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language usage text and later user-facing messages exclusively in Chinese, which effectively forces a specific language on all users. The policy allows locale constraints only when they are justified or when users are given a choice, neither of which is present here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/perf_monitor.py (reported line 36)May include surrounding context.

python

except Exception:
        # Fallback: 使用 top
        try:
            result = subprocess.run(
                ["top", "-bn1"], capture_output=True, text=True, timeout=5
            )
            for line in result.stdout.split("\n"):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diagnostic.py (reported line 185)May include surrounding context.

python

"""获取OpenClaw进程信息"""
    results = []
    try:
        result = subprocess.run(
            ["ps", "aux"], capture_output=True, text=True, timeout=5
        )
        for line in result.stdout.split("\n"):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/perf_monitor.py (reported line 125)May include surrounding context.

python

"""获取OpenClaw进程信息"""
    results = []
    try:
        result = subprocess.run(
            ["ps", "aux"], capture_output=True, text=True, timeout=5
        )
        for line in result.stdout.split("\n"):

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The argparse description, option help text, and printed monitoring/status messages are all hard-coded in Chinese. Because the file provides no language selection or justified regional limitation, this is a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language strings entirely in Chinese, including the module docstring and CLI help/output, which imposes a specific language on users. The policy allows locale constraints only when the skill offers language choice or clearly documents a justified region-specific limitation, which is not present here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/perf_report.py (reported line 24)May include surrounding context.

python

# 主机名
    try:
        info["hostname"] = subprocess.run(
            ["hostname"], capture_output=True, text=True, timeout=5
        ).stdout.strip()
    except Exception: