Core Files Management

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:57 AM UTC
• Version: 1.1.0

Overview

This skill is transparent about managing OpenClaw core files, but it broadly reads and writes sensitive workspace state and creates persistent plaintext backups without strong user controls.

Install only if you want an agent to manage all OpenClaw core workspace files. Before use, confirm each sensitive file access or modification, avoid placing secrets in core files, and clean up or protect any .bak/.backup copies created during edits.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:42

Finding

Overbroad Access to Sensitive Workspace State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–32, 42–47, 103–106, and 137–139
Vulnerability Type: Excessive read, write, and optional command-execution privileges
Risk Level: Medium

Vulnerable Code Snippets

markdown

| Verify organization | Read all core files |

markdown

| 4 | **user.md** | User context | User's info, preferences, infrastructure |
| 5 | **memory.md** | Long-term memory | Important events, key configs, workflows |
| 6 | **tools.md** | Technical configuration | Endpoints, hosts, commands, services |

markdown

| `read` | Read core files | Required |
| `write` | Modify core files | Required |
| `edit` | Fix specific sections | Optional |
| `exec` | Verify file status, backup | Optional |

text

2. Is it already somewhere else?
   → Check all 6 core files

Technical Analysis

The Skill directs an agent to read every core workspace file during organization and duplication checks. These files may contain personal information, persistent memories, infrastructure details, endpoints, hosts, commands, and service configuration.

This access pattern does not follow least privilege. A task involving one specific file does not ordinarily require access to all user, memory, and technical configuration data. The Skill also declares write access as required and command execution as optional without defining granular boundaries, explicit user authorization, secret redaction, or controls that restrict access to the minimum files necessary.

No network transmission or deliberate exfiltration is specified. The risk instead arises because sensitive information is unnecessarily loaded into the active agent context, where it could be exposed through subsequent output, untrusted instructions, compromised tools, logs, or unrelated processing.

Attack Path

1. A user invokes the Skill for a narrow task, such as reorganizing or editing one core Markdo ...[truncated 1464 chars]

Remediation

View remediation

Remediation Suggestions

1. Apply least privilege by reading only the file explicitly requested by the user.
2. Perform duplication checks incrementally rather than loading all core files by default.
3. Require explicit user authorization before accessing user.md, memory.md, or tools.md.
4. Redact secrets, credentials, tokens, private endpoints, and personal data before placing file contents in agent context.
5. Separate permissions by operation so read access does not automatically imply write access.
6. Avoid exec when native, constrained file-management tools can perform the operation.
7. If command execution is unavoidable, use fixed commands, fixed workspace paths, argument validation, and an explicit allowlist.
8. Require confirmation before modifying identity, memory, behavioral, or technical configuration files.
9. Document which files were accessed and changed without logging their sensitive contents.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:141

Finding

Plaintext Backups Can Retain Sensitive Workspace Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 141–151
Vulnerability Type: Insecure plaintext backup and sensitive-data retention
Risk Level: Low

Vulnerable Code Snippet

bash

# Create backup
cp ~/.openclaw/workspace/identity.md ~/.openclaw/workspace/identity.md.backup

# Restore from backup
cp ~/.openclaw/workspace/identity.md.backup ~/.openclaw/workspace/identity.md

# List backups
ls ~/.openclaw/workspace/*.backup

The Skill also provides a generic backup command that can be applied to any core file:

bash

cp ~/.openclaw/workspace/<file>.md ~/.openclaw/workspace/<file>.md.bak

Technical Analysis

The prescribed backup mechanism copies workspace files into adjacent .backup or .bak files without establishing restrictive permissions, encryption, secret filtering, retention limits, or secure deletion procedures.

Although the example names identity.md, the generic instructions apply to all core files. Backing up user.md, memory.md, or tools.md can duplicate personal information, persistent memory, infrastructure details, service endpoints, commands, and potentially embedded secrets. Because backups are stored in the same workspace, they may be included in broad file searches, synchronization, indexing, archival processes, or later agent reads.

Backups also preserve stale data. Removing sensitive information from the primary file does not remove it from existing backup copies, allowing information believed to be deleted to remain recoverable.

Attack Path

1. The agent prepares to modify a sensitive core file such as tools.md, user.md, or memory.md.
2. Following the Skill instructions, it creates a plaintext .bak or .backup copy in the workspace.
3. Sensitive content is subsequently removed or corrected in the primary file.
4. The backup remains unchanged and retains the original sensitive information.
5. Another local process, u ...[truncated 860 chars]

Remediation

View remediation

Remediation Suggestions

1. Set a restrictive process umask, such as umask 077, before creating backups.
2. Verify that backup files are readable and writable only by the owning account, for example with mode 0600.
3. Store backups in a dedicated access-controlled directory rather than beside active workspace files.
4. Exclude credentials, tokens, secrets, and unnecessary personal data before backup.
5. Encrypt backups containing sensitive information using managed keys.
6. Use timestamped, collision-resistant backup names and prevent accidental overwrites.
7. Define retention limits and automatically remove expired backup copies.
8. Provide a secure deletion or cryptographic erasure process where the storage environment supports it.
9. Exclude backup files from synchronization, publication, indexing, and broad agent file reads unless explicitly required.
10. Confirm backup path ownership and reject symbolic links or unexpected file types before copying.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description hard-codes a language policy: 'Between agents → Chinese' as part of the skill's rules. This is a natural-language locale policy constraint that does not provide a choice, opt-in, or region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The language rules table explicitly sets 'Between agents' to 'Chinese' as a mandatory rule. Because this forces a specific language without user choice or documented justification, it violates the natural-language policy requirements.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

bash

# List core files
ls -la ~/.openclaw/workspace/*.md

# Check file content
head -20 ~/.openclaw/workspace/identity.md

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

bash

# List core files
ls -la ~/.openclaw/workspace/*.md

# Check file content
head -20 ~/.openclaw/workspace/identity.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The skill instructs creating persistent backup copies of potentially sensitive core files without any retention, access-control, or cleanup guidance. Those files may contain user context, memory, tool configuration, or operational rules, so unmanaged backups can expand the attack surface and leave sensitive data recoverable after it should have been removed.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

Backup & Restore

bash

# Create backup
cp ~/.openclaw/workspace/identity.md ~/.openclaw/workspace/identity.md.backup

# Restore from backup

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The provided identity.md template instructs authors to set 'Between agents: Chinese' as a default requirement. This propagates a fixed language mandate into downstream files without opt-in or a documented policy exception.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.