Security audit

Openclaw Iflow Doctor

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to repair OpenClaw, but it uses persistent high-privilege monitoring and can generate destructive repair scripts without enough safeguards.

Review carefully before installing. Prefer manual/report-only use, do not install the watchdog as root or SYSTEM, inspect any generated repair script before running it, back up OpenClaw and iFlow configuration first, and avoid pasting settings files or logs that may contain API keys.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: install-systemd.sh:13
Finding: Persistent watchdog is installed with excessive system privileges
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: watchdog.py:48
Finding: Watchdog identifies and terminates processes using unsafe substring matching
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: openclaw_memory.py:1246
Finding: Repair engine reports successful automatic fixes without applying or verifying them
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: openclaw_memory.py:897
Finding: Generated repair tools perform unpinned global package replacement
Content: View full analysis
/dev/null", "cp -r \"$HOME/.openclaw/memory\" \"$BACKUP_DIR/\" 2>/dev/null", "npm uninstall -g openclaw 2>/dev/null", "npm install -g openclaw", "rm -f \"$0\"" ] } ``` The iFlow setup tool similarly installs an unpinned global package: ```python with open(bat_file, 'w', encoding='utf-8') as f: f.write("@echo off\n") f.write("echo Installing iFlow CLI...\n") f.write("npm install -g iflow\n") f.write("echo Installation completed!\n") f.write("echo Please login with: iflow login\n") f.write("pause\n") f.write('del "%~f0"\n') ``` ### Technical Analysis The repair workflow installs packages globally by package name without: - Pinning an exact version. - Verifying a lockfile or integrity hash. - Verifying the registry or package publisher. - Preserving the installed version for rollback. - Isolating the package in a project-specific environment. Mapping an unknown error to global reinstallation is especially unsafe because there is no diagnostic evidence that the installation is damaged. The effective instal ...[truncated 990 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: openclaw_memory.py:138
Finding: Weak keyword classification generates destructive executable repair scripts
Content: View full analysis
0: scores[problem_type] = score if scores: return max(scores, key=scores.get) return "unknown" ``` Generated scripts are executable by default: ```python with open(filepath, 'w', encoding='utf-8') as f: f.write("\n".join(template["commands"])) # Add executable permission on Unix systems if not is_windows: os.chmod(filepath, 0o755) generated_files.append(str(filepath)) ``` The templates contain destructive actions: ```python "reset_memory": { "filename_cn": "reset_memory_index.sh", "filename_en": "reset_memory_index.sh", "commands": [ "#!/bin/bash", "BACKUP_DIR=\"$HOME/.openclaw/memory_backup_$(date +%Y%m%d)\"", "mkdir -p \"$BACKUP_DIR\"", "cp -r \"$HOME/.openclaw/memory\" \"$BACKUP_DIR/\" 2>/dev/null", "rm -f \"$HOME/.openclaw/memory/\"index.*", "pkill -f openclaw-gateway 2>/dev/null", "sleep 2", "openclaw gateway &", "rm -f \"$0\"" ] }, "reset_config": { "filename_cn": "reset_configuration.sh", "filename_en": "reset_configuration.sh", "commands": [ "#!/bin/bash", "BACKUP_DIR=\"$HOME/.openclaw/config_backup_$(date +%Y%m%d_%H%M%S)\"", "mkdir -p \"$BACKUP_DIR\"", "cp \"$HOME/.openclaw/\"*.json \"$BACKU ...[truncated 1522 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: openclaw_memory.py:324
Finding: Potential secrets in errors and logs are persisted without redaction or restrictive permissions
Content: View full analysis
500 else error_logs) lines.append("") ``` Files are written without explicitly setting restrictive permissions: ```python with open(filepath, 'w', encoding='utf-8') as f: f.write("\n".join(lines)) ``` ### Technical Analysis Diagnostic errors commonly contain API keys, bearer tokens, webhook URLs, user identifiers, file paths, request payloads, and other sensitive data. The code truncates input but does not sanitize or redact it. The information is written to persistent JSON files under `~/.iflow/memory/openclaw` and to Desktop reports. File permissions depend entirely on the process umask and surrounding directory configuration. Desktop files may also be synchronized by cloud-storage software or included in broad backups. ### Attack Path 1. OpenClaw produces an error or log entry cont ...[truncated 690 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (140)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The quick-start text promotes automatic repair and generated fix-script execution without warning users that the skill may make system changes, execute generated code, or alter configuration automatically. This is dangerous because users may enable or rely on the skill without informed consent, while generated repair actions can introduce destructive changes, privilege misuse, or persistence if the repair logic is wrong or manipulated.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The Windows guide registers a Scheduled Task as SYSTEM with highest privileges, creating privileged persistence, but does not prominently warn users that this grants the skill continuous high-privilege execution. If the skill or its files are modified later, that persistence mechanism could be abused for full-system compromise.
Content: No source excerpt is available for this finding.

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · README.md (reported line 69)May include surrounding context.
md
| Problem Type | Generated BAT (CN) | Generated BAT (EN) | Purpose | |--------------|-------------------|-------------------|---------| | memory | 重置记忆索引.bat | reset_memory_index.bat | Reset memory index | | gateway | 重启Gateway服务.bat | restart_gateway_service.bat | Restart Gateway | | config | 重置配置文件.bat | reset_configuration.bat | Reset config | | network | 检查网络连接.bat | check_network_connection.bat | Check network |

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · openclaw_memory.py (reported line 586)May include surrounding context.
python
| Problem Type | Generated BAT (CN) | Generated BAT (EN) | Purpose | |--------------|-------------------|-------------------|---------| | memory | 重置记忆索引.bat | reset_memory_index.bat | Reset memory index | | gateway | 重启Gateway服务.bat | restart_gateway_service.bat | Restart Gateway | | config | 重置配置文件.bat | reset_configuration.bat | Reset config | | network | 检查网络连接.bat | check_network_connection.bat | Check network |

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The behavior set includes watchdog-style monitoring, health checks, process restart/termination, daemon control, and persistent logging, none of which are clearly conveyed by the headline AI-repair description. A continuously running monitor with process-control powers is materially more dangerous than a one-shot troubleshooting tool because it can disrupt services, hide faults through restarts, and persist beyond user awareness.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The behavior set includes watchdog-style monitoring, health checks, process restart/termination, daemon control, and persistent logging, none of which are clearly conveyed by the headline AI-repair description. A continuously running monitor with process-control powers is materially more dangerous than a one-shot troubleshooting tool because it can disrupt services, hide faults through restarts, and persist beyond user awareness.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The behavior set includes watchdog-style monitoring, health checks, process restart/termination, daemon control, and persistent logging, none of which are clearly conveyed by the headline AI-repair description. A continuously running monitor with process-control powers is materially more dangerous than a one-shot troubleshooting tool because it can disrupt services, hide faults through restarts, and persist beyond user awareness.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The behavior set includes watchdog-style monitoring, health checks, process restart/termination, daemon control, and persistent logging, none of which are clearly conveyed by the headline AI-repair description. A continuously running monitor with process-control powers is materially more dangerous than a one-shot troubleshooting tool because it can disrupt services, hide faults through restarts, and persist beyond user awareness.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The behavior set includes watchdog-style monitoring, health checks, process restart/termination, daemon control, and persistent logging, none of which are clearly conveyed by the headline AI-repair description. A continuously running monitor with process-control powers is materially more dangerous than a one-shot troubleshooting tool because it can disrupt services, hide faults through restarts, and persist beyond user awareness.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The behavior set includes watchdog-style monitoring, health checks, process restart/termination, daemon control, and persistent logging, none of which are clearly conveyed by the headline AI-repair description. A continuously running monitor with process-control powers is materially more dangerous than a one-shot troubleshooting tool because it can disrupt services, hide faults through restarts, and persist beyond user awareness.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · docs/iflow-auth-guide.md (reported line 225)May include surrounding context.
访问 https://iflow.cn/ 生成新的 Key

4. 清除配置重新认证

rm -rf ~/.iflow iflow

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · docs/iflow-auth-guide.md (reported line 225)May include surrounding context.
访问 https://iflow.cn/ 生成新的 Key

4. 清除配置重新认证

rm -rf ~/.iflow iflow

text

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · openclaw_memory.py (reported line 25)May include surrounding context.
python
"keywords": ["memory", "search", "identity", "remember", "记忆", "搜索"], "bat_options": ["reset_memory", "open_iflow"], "description_cn": "重置记忆索引", "description_en": "Reset Memory Index" }, "gateway": { "keywords": ["gateway", "start", "crash", "service", "服务", "启动", "崩溃"],

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The generated Unix script performs rm -f on memory index files and then restarts the gateway. Deleting stateful files based on broad issue classification is dangerous because it can destroy user data or application state, and the self-deleting script model reduces auditability and user review.
Content: Scanner excerpt · openclaw_memory.py (reported line 819)May include surrounding context.
python
"BACKUP_DIR=\"$HOME/.openclaw/memory_backup_$(date +%Y%m%d)\"", "mkdir -p \"$BACKUP_DIR\"", "cp -r \"$HOME/.openclaw/memory\" \"$BACKUP_DIR/\" 2>/dev/null", "rm -f \"$HOME/.openclaw/memory/\"index.*", "pkill -f openclaw-gateway 2>/dev/null", "sleep 2", "openclaw gateway &",

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The generated Unix script removes the main configuration file with rm -f as a repair step. Deleting configuration can erase user settings, credentials, or security-related controls, and doing so from a generated helper script without strong safeguards creates a high risk of destructive misuse.
Content: Scanner excerpt · openclaw_memory.py (reported line 845)May include surrounding context.
python
"BACKUP_DIR=\"$HOME/.openclaw/config_backup_$(date +%Y%m%d_%H%M%S)\"", "mkdir -p \"$BACKUP_DIR\"", "cp \"$HOME/.openclaw/\"*.json \"$BACKUP_DIR/\" 2>/dev/null", "rm -f \"$HOME/.openclaw/openclaw.json\"", "rm -f \"$0\"" ] },

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code marks issues as 'auto-fixed' based on matching a case or prior record, but it never executes or verifies the stored solution. This can create a dangerous false sense of remediation, causing users or downstream automation to continue operating in an insecure or broken state under the assumption the problem was fixed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document provides privileged installation and service-management commands that modify system state, enable persistence, and start services, but it does not warn users about the need for administrative review, host impact, or rollback steps. In a skill ecosystem, operators may copy-paste these commands directly, which increases the chance of unintended persistent changes on production systems.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 95% confidence
Finding: This line instructs users to execute an installer script with sudo from a root-owned workspace path, granting the script full administrative privileges. If the script is flawed, tampered with, or insufficiently reviewed, it can modify the host broadly, establish persistence, or damage configuration.
Content: Scanner excerpt · BUGFIX_STATUS.md (reported line 59)May include surrounding context.
bash
cd /root/.openclaw/workspace/skills/openclaw-iflow-doctor sudo ./install-systemd.sh

方式 2: 手动安装

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 94% confidence
Finding: Copying a service file into /etc/systemd/system/ with sudo is a privileged system modification that installs persistent service configuration. Without warning or validation guidance, users may deploy an unsafe or misconfigured unit that affects boot behavior and service security posture.
Content: Scanner excerpt · BUGFIX_STATUS.md (reported line 66)May include surrounding context.
bash
# 1. 复制服务文件 sudo cp openclaw-iflow-doctor.service /etc/systemd/system/ # 2. 重载 systemd sudo systemctl daemon-reload

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 93% confidence
Finding: sudo systemctl daemon-reload requires elevated privileges and causes systemd to reload unit definitions, which can apply newly installed or modified services. While common administratively, including it without explanation contributes to a copy-paste flow of privileged operations on the host.
Content: Scanner excerpt · BUGFIX_STATUS.md (reported line 69)May include surrounding context.
md
sudo cp openclaw-iflow-doctor.service /etc/systemd/system/ # 2. 重载 systemd sudo systemctl daemon-reload # 3. 启用并启动服务 sudo systemctl enable openclaw-iflow-doctor

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 98% confidence
Finding: sudo systemctl enable openclaw-iflow-doctor creates persistent auto-start behavior across reboots, which is a meaningful security and operational change. In the context of an agent skill, enabling persistence without explicit warning or trust guidance increases the risk that users install long-lived privileged components they have not audited.
Content: Scanner excerpt · BUGFIX_STATUS.md (reported line 72)May include surrounding context.
md
sudo systemctl daemon-reload # 3. 启用并启动服务 sudo systemctl enable openclaw-iflow-doctor sudo systemctl start openclaw-iflow-doctor # 4. 查看状态

Session Persistence

Medium

Category: Rogue Agent
Confidence: 98% confidence
Finding: The systemctl enable instruction establishes persistence across reboots, which is a classic persistence mechanism even when used for legitimate administration. In a skill-distributed document, this is security-relevant because it guides users to install a long-lived component that may continue operating unattended.
Content: Scanner excerpt · BUGFIX_STATUS.md (reported line 72)May include surrounding context.
md
sudo systemctl daemon-reload # 3. 启用并启动服务 sudo systemctl enable openclaw-iflow-doctor sudo systemctl start openclaw-iflow-doctor # 4. 查看状态

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 95% confidence
Finding: sudo systemctl start openclaw-iflow-doctor launches the service with system privileges, potentially executing unreviewed code immediately. Starting a newly installed service without documenting its runtime permissions, network behavior, and expected actions can expose the host to unintended changes or instability.
Content: Scanner excerpt · BUGFIX_STATUS.md (reported line 73)May include surrounding context.
md
# 3. 启用并启动服务 sudo systemctl enable openclaw-iflow-doctor sudo systemctl start openclaw-iflow-doctor # 4. 查看状态 systemctl status openclaw-iflow-doctor

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · BUGFIX_STATUS.md (reported line 95)May include surrounding context.
2. systemd 服务测试

bash
# 重启服务器后检查 systemctl is-enabled openclaw-iflow-doctor # 应该显示 enabled systemctl is-active openclaw-iflow-doctor # 应该显示 active

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The testing instructions include pkill -f openclaw-gateway, which forcefully terminates a service and can interrupt live operations. Because the markdown lacks a warning about service disruption, data loss, or suitability only for controlled environments, an operator could execute it on a production host and cause avoidable downtime.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T07 · Tool Hijacking and Spoofing

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Missing User Warnings

Missing User Warnings

Memory Manipulation

Memory Manipulation

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tool Parameter Abuse

访问 https://iflow.cn/ 生成新的 Key

4. 清除配置重新认证

Tool Parameter Abuse

访问 https://iflow.cn/ 生成新的 Key

4. 清除配置重新认证

Memory Manipulation

Tool Parameter Abuse

Tool Parameter Abuse

Description-Behavior Mismatch

Missing User Warnings

Sudo/Root Execution

方式 2: 手动安装

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Session Persistence

Sudo/Root Execution

Session Persistence

2. systemd 服务测试

Missing User Warnings

Static analysis