ClawHub
Back to skill

Security audit

Leak Check

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local credential-leak checker that reads OpenClaw session logs and a user-provided credential-fragment config, with no evidence of hidden network, execution, or write behavior.

Install only if you are comfortable with a local script reading your OpenClaw session logs and matching them against partial credential fragments you provide. Use fragments rather than full secrets, and consider archiving session logs instead of deleting them when clearing config echoes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
Config echoes will continue to appear on every run until the session file is removed. To clear them, delete the session file from `~/.openclaw/agents/main/sessions/`:

```bash
rm ~/.openclaw/agents/main/sessions/<session-uuid>.jsonl
```

**Tip:** Avoid reading or referencing `leak-check.json` during an OpenClaw session. If it happens, note the session ID from the report and delete it.
Confidence
85% confidence
Finding
The documentation instructs users to delete session log files directly using rm with a path template derived from report output. This is dangerous because session logs are audit artifacts and may contain important forensic history; encouraging manual deletion can lead to loss of evidence and, if copied incorrectly or generalized, accidental deletion of unintended files. The surrounding context makes this more sensitive because the skill is specifically handling credential leak detection, where preserving logs is often important for investigation.

Ae1

High
Category
analysis-evasion
Content
This skill is designed to be **local-only and read-only**. The following properties can be verified by inspecting `scripts/leak-check.js`:
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
This skill is designed to be **local-only and read-only**. The following properties can be verified by inspecting `scripts/leak-check.js`:
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Credential Access

High
Category
Privilege Escalation
Content
Confirm no unexpected APIs are used anywhere in the script:

```bash
grep -E 'require\(|import |http|fetch|net\.|dgram|child_process|exec|spawn|eval\(|Function\(|\.write|\.unlink|\.rename|process\.env' scripts/leak-check.js
```

Expected output — only the three built-in `require()` calls at the top of the file:
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium
Category
Rogue Agent
Content
Since clawhub clears the skill directory on updates, place your config in `~/.openclaw/credentials/` to avoid losing it:

```bash
mkdir -p ~/.openclaw/credentials
cp leak-check.json ~/.openclaw/credentials/leak-check.json
```
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.