雷神之影 Mjolnir Shadow

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:37 PM UTC
• Version: 2.0.0

Overview

This skill matches a backup-and-restore purpose, but it overstates its encryption and includes high-impact restore and bootstrap behavior that can overwrite trusted OpenClaw state or install system software from network sources.

Review before installing. Use only HTTPS WebDAV, assume the remote server can read backup contents unless the payload encryption is fixed, avoid the default restore-kit bootstrap on machines you care about, and do not run restore on archives you have not independently verified. Keep a separate local backup before using --auto restore because it can overwrite OpenClaw memory, config, strategies, and installed skills.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/restore-kit.sh:238

Finding

Remote NodeSource Script Is Executed with Elevated Privileges Without Integrity Verification

Content

View full analysis

/dev/null | $SUDO bash - 2>/dev/null; then $SUDO apt-get install -y -qq nodejs 2>/dev/null else ``` ### Technical Analysis The restore kit downloads a mutable shell script from an external URL and immediately pipes it into `bash`. When the user is not root, `$SUDO` is set to `sudo`, causing the remotely retrieved script to execute with root privileges. The downloaded content is not pinned to a cryptographic digest, authenticated using a separately verified signature, saved for inspection, or otherwise checked before execution. Although HTTPS protects the connection under normal circumstances, it does not protect against compromise of the remote distribution server, its publishing pipeline, DNS or certificate infrastructure, or an account authorized to modify the script. The effective code executed by the audited package can therefore change after the package itself has been reviewed. ### Attack Path 1. An attacker compromises the NodeSource endpoint, publishing process, hosting account, or another part of the trusted delivery chain. 2. The attacker modifies `setup_22.x` to include arbitrary shell commands. 3. A user runs `scripts/restore-kit.sh` during recovery. 4. The script downloads the current remote response. 5. The response is passed directly to `sudo bash`. 6. The attacker's commands execute as root without any local integrity check. ### Impact Assessment Successful exploitation provides arbitrary root-level code execution on the recovering machine. The attacker could: - Read or modify all accessible files and credentials. - Install persistent services, scheduled tasks, or backdoors. - Replace system binaries or security tools. - Ca ...[truncated 237 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/restore.sh:245

Finding

Unsigned WebDAV Archives Are Automatically Extracted into Trusted OpenClaw Directories

Content

View full analysis

/dev/null echo -e " ${GREEN}✓${NC} workspace → ${WORKSPACE_PATH}" restored=$((restored + 1)) fi # Config if [ -f "$RESTORE_DIR/config.tar.gz" ]; then mkdir -p "$OPENCLAW_DIR" tar xzf "$RESTORE_DIR/config.tar.gz" -C "$OPENCLAW_DIR" 2>/dev/null echo -e " ${GREEN}✓${NC} config → ${OPENCLAW_DIR}" restored=$((restored + 1)) fi # Strategies if [ -f "$RESTORE_DIR/strategies.tar.gz" ]; then local strat_dir="${OPENCLAW_DIR}/workspace/projects/auto_trading" mkdir -p "$strat_dir" tar xzf "$RESTORE_DIR/strategies.tar.gz" -C "$strat_dir" 2>/dev/null echo -e " ${GREEN}✓${NC} strategies → ${strat_dir}" restored=$((restored + 1)) fi # Skills if [ -f "$RESTORE_DIR/skills.tar.gz" ]; then local skills_dir="${OPENCLAW_DIR}/workspace/skills" mkdir -p "$skills_dir" tar xzf "$RESTORE_DIR/skills.tar.gz" -C "${OPENCLAW_DIR}/workspace" 2>/dev/null echo -e " ${GREEN}✓${NC} skills → ${skills_dir}" restored=$((restored + 1)) fi ``` The standalone kit performs the same operation: ```bash mkdir -p "$RESTORE_DIR" tar xzf "$DL_FILE" -C "$RESTORE_DIR" rm -f "$DL_FILE" if [ -f "$RESTORE_DIR/workspace.tar.gz" ]; then mkdir -p "$WORKSPACE_PATH" tar xzf "$RESTORE_DIR/workspace.tar.gz" -C "$WORKSPACE_PATH" 2 ...[truncated 2816 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/restore-kit.sh:278

Finding

Recovery Kit Installs Unpinned Global npm Packages

Content

View full analysis

/dev/null; then ok "OpenClaw 安装成功" OPENCLAW_OK=true elif npm install -g openclaw-cn 2>/dev/null; then ok "OpenClaw (CN) 安装成功" OPENCLAW_OK=true else # Try with user prefix info "全局安装失败，尝试用户目录..." mkdir -p "$HOME/.npm-global" npm config set prefix "$HOME/.npm-global" 2>/dev/null export PATH="$HOME/.npm-global/bin:$PATH" if npm install -g openclaw 2>/dev/null; then ok "OpenClaw 安装成功 (用户目录)" OPENCLAW_OK=true ``` ### Technical Analysis The script installs the current registry versions of `openclaw` or, if that fails, `openclaw-cn`. Neither package is pinned to a reviewed version or integrity digest. npm package installation may execute lifecycle scripts, and the globally installed executable is subsequently trusted and used to start the OpenClaw gateway. Automatically substituting a second package also expands the supply-chain trust boundary without requiring explicit user approval. A new release, compromised maintainer account, registry compromise, or malicious transitive dependency could alter the code executed during recovery. ### Attack Path 1. An attacker compromises a relevant npm package, maintainer account, release process, or transitive dependency. 2. A malicious package version is published as the current version. 3. A victim runs the standalone restore kit. 4. The script installs the latest package globally or into a user-controlled global prefix. 5. npm executes package installation or lifecycle code. 6. The script later invokes the installed `openclaw` executable. 7. Malicious code runs with the privileges of the recovery-kit user. ### Impa ...[truncated 462 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup.sh:13

Finding

Predictable Temporary netrc Paths Permit Credential Disclosure and Symlink Attacks

Content

View full analysis

/dev/null } trap cleanup EXIT ``` The credential file is later created non-atomically: ```bash WEBDAV_HOST=$(echo "$WEBDAV_URL" | grep -oP '://\K[^/]+') cat > "$NETRC_FILE" << EOF machine ${WEBDAV_HOST} login ${WEBDAV_USER} password ${WEBDAV_PASS} EOF chmod 600 "$NETRC_FILE" CURL_AUTH="--netrc-file ${NETRC_FILE}" ``` Equivalent patterns include: ```bash NETRC_FILE="/tmp/.mjolnir_shadow_netrc_$$" ``` in `scripts/restore.sh`, and: ```bash NETRC_FILE="/tmp/.mjolnir_restore_kit_netrc_$$" ``` in `scripts/restore-kit.sh`. ### Technical Analysis The scripts derive temporary credential-file names from the process ID and place them in the shared `/tmp` directory. Process IDs are predictable, and shell redirection opens the target before `chmod 600` is applied. There is no atomic exclusive creation, no private temporary directory, and no check that the path is a regular file rather than a symbolic link. A local attacker may pre-create the predicted path as a symlink. The victim's shell can then follow that link when processing `cat > "$NETRC_FILE"`. There is also a permissions race: the file may initially be created according to the caller's existing umask, and only afterward changed to mode 0600. ### Attack Path 1. A local attacker observes or predicts the victim script's process ID. 2. The attacker creates `/tmp/.mjolnir_shadow_netrc_` as a symbolic link to: - A file readable by the attacker, or - Another file writabl ...[truncated 1004 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup_backup.py:16

Finding

GPG Passphrases Are Passed Through Process Command-Line Arguments

Content

View full analysis

/dev/null ``` ### Technical Analysis The GPG passphrase is provided as the argument following `--passphrase`. Command-line arguments may be exposed through process-inspection interfaces, diagnostic tools, audit systems, crash telemetry, or process-monitoring software, depending on platform and local security configuration. The setup wizard also reads a newly selected encryption passphrase using ordinary `input()` rather than a no-echo password prompt, causing the secret to be displayed on the terminal while entered. Possession of the passphrase allows decryption of the configuration containing the WebDAV username and password. ### Attack Path 1. An attacker with local process-observation capability waits for backup, restore, or setup execution. 2. The victim invokes GPG with the passphrase in the argument vector. 3. The attacker captures the GPG process arguments through available process or monitoring facilities. 4. ...[truncated 796 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup.sh:103

Finding

Documented Secret-File Exclusions Are Incomplete and Inconsistently Applied

Content

View full analysis

/dev/null || echo "⚠️ Workspace pack had warnings (non-fatal)" ``` Configuration backup does not exclude general key files: ```bash tar czf "$BACKUP_DIR/config.tar.gz" \ -C "$OPENCLAW_DIR" \ $EXCLUDE_ARGS \ --exclude='*.gpg' \ --exclude='*.secret' \ --exclude='.env' \ openclaw.json \ cron/ \ 2>/dev/null || echo "⚠️ Config pack had warnings (non-fatal)" ``` Strategy backup has no secret-file exclusions: ```bash tar czf "$BACKUP_DIR/strategies.tar.gz" \ -C "$STRAT_DIR" \ --exclude='venv' --exclude='__pycache__' --exclude='*.pyc' \ strategies/ monitor/ 2>/dev/null || echo "⚠️ Strategies pack had warnings" ``` Skills backup excludes several patterns but not general key files: ```bash tar czf "$BACKUP_DIR/skills.tar.gz" \ -C "$OPENCLAW_DIR/workspace" \ --exclude='node_modules' --exclude='venv' --exclude='.venv' \ --exclude='__pycache__' --exclude='*.pyc' \ --exclude='*.gpg' --exclude='*.secret' --exclude='.env' \ skills/ 2>/dev/null || echo "⚠️ Skills pack had warnings" ``` ### Technical Analysis The documentation states that `.gpg`, `.key`, `.secret`, and `.env` files are always excluded. The implementation does not enforce that guarantee consistently: - Workspace `*.key` exclusion applies only to `secrets/*.key`. - Strategy archives do not exclude `.gpg`, `.key`, `.secret`, or `.env`. - Configuration and skill archives ...[truncated 1495 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_backup.py:87

Finding

WebDAV Credentials and Backup Data May Be Transmitted over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (56)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description emphasizes encrypted backup creation, while the documented restore modes write and extract files back into OpenClaw directories and restart the gateway. That creates a materially different trust boundary: remote backup contents can become local executable/config state, which is dangerous if the restore path is not clearly disclosed and separately authorized.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill description emphasizes encrypted backup creation, while the documented restore modes write and extract files back into OpenClaw directories and restart the gateway. That creates a materially different trust boundary: remote backup contents can become local executable/config state, which is dangerous if the restore path is not clearly disclosed and separately authorized.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/backup.sh (reported line 102)May include surrounding context.

sh

--exclude='*.pyc' \
    --exclude='secrets/*.gpg' \
    --exclude='secrets/*.key' \
    --exclude='.env' \
    --exclude='*.secret' \
    . 2>/dev/null || echo "⚠️ Workspace pack had warnings (non-fatal)"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/backup.sh (reported line 118)May include surrounding context.

sh

--exclude='*.pyc' \
    --exclude='secrets/*.gpg' \
    --exclude='secrets/*.key' \
    --exclude='.env' \
    --exclude='*.secret' \
    . 2>/dev/null || echo "⚠️ Workspace pack had warnings (non-fatal)"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/backup.sh (reported line 143)May include surrounding context.

sh

--exclude='*.pyc' \
    --exclude='secrets/*.gpg' \
    --exclude='secrets/*.key' \
    --exclude='.env' \
    --exclude='*.secret' \
    . 2>/dev/null || echo "⚠️ Workspace pack had warnings (non-fatal)"
fi

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill metadata and comments claim GPG-encrypted backups, but this script creates and uploads only a plain .tar.gz archive to WebDAV. That means workspace data, configs, and potentially sensitive operational files are stored readable by the WebDAV server or any attacker who gains access to it, creating a serious confidentiality gap between the advertised and actual behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The restore script goes far beyond restoring backups: it provisions packages, installs Node.js, installs OpenClaw, and starts services. For a backup skill, this broadens the trust boundary significantly and turns a data-restore operation into full host modification, increasing the blast radius if the script or upstream sources are compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatically installing curl, python3, gnupg, and git modifies the host system and may invoke privileged package managers, which is outside the narrow scope users expect from a backup restore tool. In the context of a skill, that behavior is dangerous because it normalizes privilege escalation and expands the attack surface before restore even begins.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script installs Node.js and OpenClaw from external sources, including piping a fetched setup script into bash and extracting downloaded binaries into /usr/local. This creates a supply-chain and privilege-risk path where compromise of upstream content or transport directly leads to arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/restore-kit.sh (reported line 253)May include surrounding context.

sh

NODE_URL="https://nodejs.org/dist/v22.12.0/node-v22.12.0-linux-${NODE_ARCH}.tar.xz"
      if curl -fsSL "$NODE_URL" -o /tmp/node.tar.xz 2>/dev/null; then
        $SUDO tar -xJf /tmp/node.tar.xz -C /usr/local --strip-components=1 2>/dev/null
        rm -f /tmp/node.tar.xz
      fi
    fi
  fi

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/restore-kit.sh (reported line 265)May include surrounding context.

sh

else
    fail "Node.js 安装失败"
    echo -e "\n       ${YELLOW}请手动安装:${NC}"
    echo -e "       ${DIM}curl -fsSL https://deb.nodesource.com/setup_22.x | sudo bash -${NC}"
    echo -e "       ${DIM}sudo apt install -y nodejs${NC}"
    echo -e "       ${DIM}然后重新运行: bash restore-kit.sh --skip-env${NC}"
  fi

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/restore-kit.sh (reported line 596)May include surrounding context.

sh

else
    fail "Node.js 安装失败"
    echo -e "\n       ${YELLOW}请手动安装:${NC}"
    echo -e "       ${DIM}curl -fsSL https://deb.nodesource.com/setup_22.x | sudo bash -${NC}"
    echo -e "       ${DIM}sudo apt install -y nodejs${NC}"
    echo -e "       ${DIM}然后重新运行: bash restore-kit.sh --skip-env${NC}"
  fi

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/restore-kit.sh (reported line 596)May include surrounding context.

sh

if ! command -v openclaw &>/dev/null; then
  echo -e "  ${YELLOW}📌 还需要:${NC}"
  if ! command -v node &>/dev/null; then
    echo -e "     1. 安装 Node.js:  ${CYAN}curl -fsSL https://deb.nodesource.com/setup_22.x | sudo bash - && sudo apt install -y nodejs${NC}"
    echo -e "     2. 安装 OpenClaw: ${CYAN}npm install -g openclaw${NC}"
    echo -e "     3. 启动服务:     ${CYAN}openclaw gateway start${NC}"
  else

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

restore_manual writes the downloaded backup to /tmp/${BACKUP_FILE} and later deletes that same path, where BACKUP_FILE is user-controlled in --file mode. An attacker can supply a filename containing path traversal sequences like ../../../somefile so the script may overwrite or delete unintended files accessible to the current user.

Content

Scanner excerpt · scripts/restore.sh (reported line 201)May include surrounding context.

sh

echo "      tar xzf ${RESTORE_DIR}/config.tar.gz -C ~/.openclaw/"
  echo ""

  rm -f "/tmp/${BACKUP_FILE}"
  echo "✅ Ready at / 就绪: ${RESTORE_DIR}"
}

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README states that the PowerShell script provides '全程中文提示' (Chinese prompts throughout), and the document consistently presents the experience as Chinese-only rather than offering a language choice. For a general-purpose backup and restore skill, fixing the interaction language without opt-in can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README expands the skill from backup/restore into full machine bootstrap, including installing WSL2, Ubuntu, Node.js, and OpenClaw on fresh systems. That broader operational scope increases trust and blast radius: a user invoking a 'backup' skill may unknowingly permit system-wide changes beyond data restoration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises fully automated restore and system installation flows without clearly warning that they may overwrite local files, reinstall components, or alter system configuration. In practice, this can lead to destructive user actions, especially during stressful disaster recovery scenarios when users are likely to run commands without reviewing consequences.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Documenting fresh-system installation of OS and runtime components is broader than necessary for a backup skill and can normalize excessive privilege and host modification. If users trust this as a simple restore utility, they may run scripts that perform substantial system changes with elevated permissions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill advertises and documents shell, file, and network-capable operations but does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, missing scope makes it easier for the skill to be invoked with broader-than-expected capabilities, reducing reviewability and increasing the chance of unintended file modification, data exfiltration, or command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list includes broad phrases such as backup, data safety, disaster recovery, workspace protection, and system backup, which can match ordinary conversation and cause unintended invocation. For a skill with shell, file, and network behavior, accidental activation could lead to unexpected backup, restore, or remote-transfer actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes a backup configuration that includes a remote WebDAV endpoint, username, and password, and enables automatic backup of workspace, config, strategies, and installed skills. It does not warn users that data will be transmitted to a remote server or that sensitive local content may be included in backups.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown explains that when the backup count reaches the limit, the oldest remote backup files are deleted automatically. Because this is a destructive operation affecting user data retention, the documentation should clearly warn users about the deletion behavior and its implications.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Although WebDAV credentials are moved into a netrc file, the GPG passphrase is still supplied via --passphrase on the command line when MJOLNIR_SHADOW_PASS is set. On many systems, command-line arguments can be observed by other local users or monitoring tools, so the claim that credentials are never exposed in process listings is inaccurate and can leak the decryption secret protecting the backup configuration.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/backup.sh (reported line 65)May include surrounding context.

sh

login ${WEBDAV_USER}
password ${WEBDAV_PASS}
EOF
chmod 600 "$NETRC_FILE"
CURL_AUTH="--netrc-file ${NETRC_FILE}"

# ── HTTPS Check ──────────────────────────────────────────────

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/restore-kit.sh (reported line 405)May include surrounding context.

sh

login ${WEBDAV_USER}
password ${WEBDAV_PASS}
EOF
chmod 600 "$NETRC_FILE"
CURL_AUTH="--netrc-file ${NETRC_FILE}"

# ── HTTPS Check ──────────────────────────────────────────────

Static analysis

No suspicious patterns detected.