ClawHub
Back to skill

Security audit

雷神之脑 v3.0.2

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local memory skill, but it gives agents and optional automation broad persistent control over behavior files, git history, backups, and cron entries that users should review carefully.

Use this only in an isolated workspace you are comfortable making persistent. Before enabling optional scripts, review them, avoid storing secrets in the workspace, replace whole-workspace auto commits with a narrow allowlist, use HTTPS or encrypted backups only, validate SSH backup paths, and manually review any proposed changes to AGENTS.md, SOUL.md, and TOOLS.md.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T02 · Agent Memory Poisoning

Error
Location
templates/AGENTS.md:64
Finding

Persistent Self-Modification of Agent Control Files Enables Memory Poisoning

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/auto_commit.sh:17
Finding

Hourly Automation Commits the Entire Workspace to Git History

Content
View full analysis
/dev/null || true ``` The installation documentation recommends optionally running this script every hour: ```cron # Auto git commit — every hour 0 * * * * ~/.openclaw/workspace/scripts/auto_commit.sh ``` ### Technical Analysis `git add -A` stages every tracked, modified, deleted, and untracked file under the workspace. The operation is not limited to memory-system files. No path allowlist, secret scan, size limit, or interactive review is performed before committing. A Git commit makes sensitive data durable even if the original file is later deleted. Removing a file in a subsequent commit does not remove it from previous Git history. The script does not execute `git push`, so it does not independently transmit data. Nevertheless, committed secrets can later be exposed when the repository is pushed, backed up, copied, or shared. ### Attack Path 1. A credential, API token, private key, confidential document, or generated secret is created or copied anywhere inside the workspace. 2. The user has enabled the documented hourly cron job. 3. `auto_commit.sh` executes and runs `git add -A`. 4. The sensitive file is committed without review. 5. The user deletes or ignores the original file, incorrectly assuming the data is gone. 6. The repository is later pushed, archived, backed up, or shared. 7. The sensitive content remains recoverable from Git history. An attacker who can cause a sensitive file to be written into the workspace may use the same sequence to place that data into durable repository history. ### Impact Assessment The issue can expose any data readable within the configured workspace, in ...[truncated 449 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/workspace_backup.sh:81
Finding

Remote Backup Permits Plaintext Transfer and Unsafe Remote Shell Construction

Content
View full analysis
/dev/null || [ $? -eq 1 ] SIZE=$(du -h "$ARCHIVE" | cut -f1) log "Archive: $ARCHIVE ($SIZE)" # === Target 1: WebDAV === if [ -n "$BACKUP_WEBDAV_URL" ] && [ -n "$BACKUP_WEBDAV_USER" ]; then curl -s -X MKCOL -u "$BACKUP_WEBDAV_USER:$BACKUP_WEBDAV_PASS" "$BACKUP_WEBDAV_URL" 2>/dev/null || true HTTP=$(curl -s -o /dev/null -w "%{http_code}" \ -u "$BACKUP_WEBDAV_USER:$BACKUP_WEBDAV_PASS" \ -T "$ARCHIVE" \ "${BACKUP_WEBDAV_URL}workspace_${TIMESTAMP}.tar.gz" \ --connect-timeout 10 --max-time 120 2>/dev/null) ``` ```bash # === Target 2: SSH === if [ -n "$BACKUP_SSH_HOST" ] && [ -n "$BACKUP_SSH_PATH" ]; then ssh "$BACKUP_SSH_HOST" "mkdir -p $BACKUP_SSH_PATH" 2>/dev/null if scp -q "$ARCHIVE" "$BACKUP_SSH_HOST:$BACKUP_SSH_PATH/" 2>/dev/null; then log "✅ SSH: uploaded to $BACKUP_SSH_HOST:$BACKUP_SSH_PATH" # Rotate old backups ssh "$BACKUP_SSH_HOST" "cd $BACKUP_SSH_PATH && ls -t workspace_*.tar.gz | tail -n +$((KEEP_COUNT+1)) | xargs rm -f 2>/dev/null" || true else log "❌ SSH: upload failed" fi fi ``` ### Technical Analysis The script packages the entire workspace, including memory and potentially sensitive user data. Its example configuration explicitly uses an `http://` WebDAV URL. With HTTP Basic authentication over an unencrypted connection, the username and password are only Base64-encoded and can be intercepted. The archiv ...[truncated 2312 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
INSTALL.md:164
Finding

Uninstall Command Deletes Unrelated OpenClaw Cron Jobs

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (121)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · INSTALL.md (reported line 149)May include surrounding context.

.md` is deleted 4. The memory system runs automatically from here

Verification

After installation, check that everything is in place:

bash
cd ~/.openclaw/workspace

# Templates
ls -la AGENTS.md SOUL.md MEMORY.md HEARTBEAT.md BOOTSTRAP.md

# Scripts
ls -la scripts/*.sh

# Strategy registry
cat strategies.json | python3 -m json.tool | head -5

# Memory directory
ls -la memory/

# Cron jobs
crontab -l | grep openclaw

Uninstall

bash
# Remove scripts (keep your data!)
rm -rf ~/.openclaw/workspace/scripts/memory_consolidate.sh
rm -rf ~/.openclaw/workspace/scripts/memory_search.sh
rm -rf ~/.openclaw/workspace/scripts/strategy_*.sh
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh
rm -rf ~/.openclaw/workspace/scripts/workspace_backup.sh
rm -rf ~/.openclaw/workspace/scripts/daily_log_init.sh
rm -f ~/.openclaw/workspace/strategies.json

# Remove cron jobs
crontab -l | grep -v openclaw | crontab -

# Your MEMORY.md, AGENTS.md, SOUL.md etc. are YOUR data — keep them!

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 156)May include surrounding context.

bash
# Remove scripts (keep your data!)
rm -rf ~/.openclaw/workspace/scripts/memory_consolidate.sh
rm -rf ~/.openclaw/workspace/scripts/memory_search.sh
rm -rf ~/.openclaw/workspace/scripts/strategy_*.sh
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 157)May include surrounding context.

bash
# Remove scripts (keep your data!)
rm -rf ~/.openclaw/workspace/scripts/memory_consolidate.sh
rm -rf ~/.openclaw/workspace/scripts/memory_search.sh
rm -rf ~/.openclaw/workspace/scripts/strategy_*.sh
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 158)May include surrounding context.

bash
# Remove scripts (keep your data!)
rm -rf ~/.openclaw/workspace/scripts/memory_consolidate.sh
rm -rf ~/.openclaw/workspace/scripts/memory_search.sh
rm -rf ~/.openclaw/workspace/scripts/strategy_*.sh
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 159)May include surrounding context.

bash
# Remove scripts (keep your data!)
rm -rf ~/.openclaw/workspace/scripts/memory_consolidate.sh
rm -rf ~/.openclaw/workspace/scripts/memory_search.sh
rm -rf ~/.openclaw/workspace/scripts/strategy_*.sh
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 160)May include surrounding context.

bash
# Remove scripts (keep your data!)
rm -rf ~/.openclaw/workspace/scripts/memory_consolidate.sh
rm -rf ~/.openclaw/workspace/scripts/memory_search.sh
rm -rf ~/.openclaw/workspace/scripts/strategy_*.sh
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 161)May include surrounding context.

bash
# Remove scripts (keep your data!)
rm -rf ~/.openclaw/workspace/scripts/memory_consolidate.sh
rm -rf ~/.openclaw/workspace/scripts/memory_search.sh
rm -rf ~/.openclaw/workspace/scripts/strategy_*.sh
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 156)May include surrounding context.

bash
# Remove scripts (keep your data!)
rm -rf ~/.openclaw/workspace/scripts/memory_consolidate.sh
rm -rf ~/.openclaw/workspace/scripts/memory_search.sh
rm -rf ~/.openclaw/workspace/scripts/strategy_*.sh
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 157)May include surrounding context.

bash
# Remove scripts (keep your data!)
rm -rf ~/.openclaw/workspace/scripts/memory_consolidate.sh
rm -rf ~/.openclaw/workspace/scripts/memory_search.sh
rm -rf ~/.openclaw/workspace/scripts/strategy_*.sh
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh
rm -rf ~/.openclaw/workspace/scripts/workspace_backup.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 158)May include surrounding context.

md
# Remove scripts (keep your data!)
rm -rf ~/.openclaw/workspace/scripts/memory_consolidate.sh
rm -rf ~/.openclaw/workspace/scripts/memory_search.sh
rm -rf ~/.openclaw/workspace/scripts/strategy_*.sh
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh
rm -rf ~/.openclaw/workspace/scripts/workspace_backup.sh
rm -rf ~/.openclaw/workspace/scripts/daily_log_init.sh

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 159)May include surrounding context.

md
rm -rf ~/.openclaw/workspace/scripts/memory_consolidate.sh
rm -rf ~/.openclaw/workspace/scripts/memory_search.sh
rm -rf ~/.openclaw/workspace/scripts/strategy_*.sh
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh
rm -rf ~/.openclaw/workspace/scripts/workspace_backup.sh
rm -rf ~/.openclaw/workspace/scripts/daily_log_init.sh
rm -f ~/.openclaw/workspace/strategies.json

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 160)May include surrounding context.

md
rm -rf ~/.openclaw/workspace/scripts/memory_search.sh
rm -rf ~/.openclaw/workspace/scripts/strategy_*.sh
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh
rm -rf ~/.openclaw/workspace/scripts/workspace_backup.sh
rm -rf ~/.openclaw/workspace/scripts/daily_log_init.sh
rm -f ~/.openclaw/workspace/strategies.json

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 161)May include surrounding context.

md
rm -rf ~/.openclaw/workspace/scripts/strategy_*.sh
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh
rm -rf ~/.openclaw/workspace/scripts/workspace_backup.sh
rm -rf ~/.openclaw/workspace/scripts/daily_log_init.sh
rm -f ~/.openclaw/workspace/strategies.json

# Remove cron jobs

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 162)May include surrounding context.

md
rm -rf ~/.openclaw/workspace/scripts/auto_commit.sh
rm -rf ~/.openclaw/workspace/scripts/workspace_backup.sh
rm -rf ~/.openclaw/workspace/scripts/daily_log_init.sh
rm -f ~/.openclaw/workspace/strategies.json

# Remove cron jobs
crontab -l | grep -v openclaw | crontab -

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

If the skill includes local user-management behavior such as writing state to ~/.mjolnir_current_user and deleting user directories, that is far beyond a simple self-evolving memory system. Writing into a home directory and deleting data introduces persistence and destructive capability that users may not anticipate from the declared description. Misdocumented multi-user isolation logic can therefore lead to privacy issues, data loss, or misuse of local account-like state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

If the skill includes local user-management behavior such as writing state to ~/.mjolnir_current_user and deleting user directories, that is far beyond a simple self-evolving memory system. Writing into a home directory and deleting data introduces persistence and destructive capability that users may not anticipate from the declared description. Misdocumented multi-user isolation logic can therefore lead to privacy issues, data loss, or misuse of local account-like state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

If the skill includes local user-management behavior such as writing state to ~/.mjolnir_current_user and deleting user directories, that is far beyond a simple self-evolving memory system. Writing into a home directory and deleting data introduces persistence and destructive capability that users may not anticipate from the declared description. Misdocumented multi-user isolation logic can therefore lead to privacy issues, data loss, or misuse of local account-like state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

If the skill includes local user-management behavior such as writing state to ~/.mjolnir_current_user and deleting user directories, that is far beyond a simple self-evolving memory system. Writing into a home directory and deleting data introduces persistence and destructive capability that users may not anticipate from the declared description. Misdocumented multi-user isolation logic can therefore lead to privacy issues, data loss, or misuse of local account-like state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

If the skill includes local user-management behavior such as writing state to ~/.mjolnir_current_user and deleting user directories, that is far beyond a simple self-evolving memory system. Writing into a home directory and deleting data introduces persistence and destructive capability that users may not anticipate from the declared description. Misdocumented multi-user isolation logic can therefore lead to privacy issues, data loss, or misuse of local account-like state.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The task message schema includes an action value of execute_command, documenting remote command execution capability in a skill described as a local memory system. Even though this is only a spec, it normalizes an unsafe control channel that could be implemented to let one node trigger arbitrary command execution on another, leading to code execution, data loss, credential theft, or lateral movement across the local network.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · playbooks/multi-user-setup.md (reported line 136)May include surrounding context.

scripts/user.sh create alice scripts/user.sh switch alice

text

---

## Scenario 3: Add New Team Member

### Step 1: Create User

```bash
scripts/user.sh create <new_username>

Step 2: Set Permissions

bash
scripts/set_permissions.sh

Step 3: Configure User's Environment

New user runs:

bash
scripts/user.sh switch <their_username>

Or adds to their shell config:

bash
echo 'export MJOLNIR_USER=<their_username>' >> ~/.bashrc
source ~/.bashrc

Scenario 4: Shared Project Setup

Step 1: Create Project Directory

bash
mkdir -p templates/memory/shared/projects/<project_name>

Step 2: Add Project Context

Create templates/memory/shared/projects/<project_name>/CONTEXT.md:

markdown
# Project: <Project Name>

## Overview
Brief description of the project.

## Key Decisions
- Decision 1
- Decision 2

## Related Files
- Link to relevant files

Step 3: Set Permissions

bash
chmod 755 templates/memory/shared/projects/<project_na

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/工作记录机制.md (reported line 38)May include surrounding context.

md
echo ""
    echo "示例："
    echo "  ./log_work.sh \"Day-1 内容创作\" \"docs/articles/Day-01-为什么选 OpenClaw.md\""
    echo "  ./log_work.sh \"配置 SSH 免密\" \".ssh/authorized_keys\""
    exit 1
fi

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/log_work.sh (reported line 22)May include surrounding context.

sh
echo ""
    echo "示例："
    echo "  ./log_work.sh \"Day-1 内容创作\" \"docs/articles/Day-01-为什么选 OpenClaw.md\""
    echo "  ./log_work.sh \"配置 SSH 免密\" \".ssh/authorized_keys\""
    exit 1
fi

Chaining Abuse

High
Category
Tool Misuse
Confidence
93% confidence
Finding

The remote cleanup command builds a shell pipeline using unquoted, user-configurable input in "$BACKUP_SSH_PATH" inside a command string executed by ssh. Because the remote shell parses that string, a crafted BACKUP_SSH_PATH containing shell metacharacters can inject arbitrary commands on the remote host; additionally, piping ls output into xargs rm is unsafe and can delete unintended files if filenames contain whitespace or special characters.

Content

Scanner excerpt · scripts/workspace_backup.sh (reported line 102)May include surrounding context.

sh
if scp -q "$ARCHIVE" "$BACKUP_SSH_HOST:$BACKUP_SSH_PATH/" 2>/dev/null; then
        log "✅ SSH: uploaded to $BACKUP_SSH_HOST:$BACKUP_SSH_PATH"
        # Rotate old backups
        ssh "$BACKUP_SSH_HOST" "cd $BACKUP_SSH_PATH && ls -t workspace_*.tar.gz | tail -n +$((KEEP_COUNT+1)) | xargs rm -f 2>/dev/null" || true
    else
        log "❌ SSH: upload failed"
    fi

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · templates/memory/partitions/example-creative.md (reported line 5)May include surrounding context.

md
# 🎨 Creative — 创作类分区示例
<!-- Partition: example-creative -->
<!-- Keywords: 创作, 故事, 写作, 角色, IP, creative, story, writing, character -->
<!-- Max Size: 20KB -->
<!-- Description: 存储创作相关的记忆，包括故事线、角色设定、写作风格偏好等 -->

> **这是一个示例分区文件。** 实际使用时，替换为你自己的内容。
> This is an example partition file. Replace with your own content when using.

## 📖 故事线 / Story Arcs

- （示例）第一季主线：英雄觉醒 → 试炼 → 对决
- （示例）支线：伙伴关系发展，伏笔回收

## 🧑‍🎨 角色设定 / Character Profiles

- （示例）主角：性格特征、成长弧线、口头禅
- （示例）反派：动机、弱点、与主角的镜�

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
INSTALL.md:156