OpenClaw Claude Code 百炼配置

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:39 AM UTC
• Version: 1.0.0

Overview

This is a coherent Claude Code helper, but it needs review because some setup examples can run unverified remote code or expose credentials if copied directly.

Install only if you are comfortable reviewing commands before running them. Prefer WinGet or a verified installer instead of piping a remote PowerShell script into execution, replace placeholder MCP commands with pinned packages from trusted publishers, avoid sending sensitive logs or diffs to model providers, and store API keys using protected secret-handling practices with least-privilege scopes.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:21

Finding

Remote PowerShell Installer Is Downloaded and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Complete Code Snippet:

powershell

irm https://claude.ai/install.ps1 | iex

Technical Analysis

The installation instruction uses Invoke-RestMethod (irm) to retrieve a mutable PowerShell script from an external URL and immediately passes its contents to Invoke-Expression (iex). This creates a direct remote-code-execution channel: the effective payload is determined at execution time rather than being fixed and reviewable in the Skill package.

HTTPS protects the connection in transit but does not provide payload pinning. The command does not verify a cryptographic digest, digital signature, fixed release version, or locally reviewed copy before execution. Consequently, compromise of the hosting endpoint, publishing account, delivery infrastructure, or remote script could cause arbitrary commands to run with the privileges of the user operating OpenClaw.

Installing Claude Code is relevant to the Skill's declared purpose, but immediate execution of mutable remote content exceeds the minimum privileges and trust necessary to perform that installation.

Attack Path

1. An attacker compromises or gains control over the remote installer or its delivery infrastructure.
2. The attacker modifies install.ps1 to include malicious PowerShell commands.
3. A user follows the installation command from SKILL.md.
4. irm downloads the attacker-controlled content.
5. The pipeline sends that content directly to iex without inspection or integrity verification.
6. The malicious commands execute with the invoking user's current privileges.

Impact Assessment

Successful exploitation provides arbitrary code execution under the invoking user's security context. Depending on that account's permissions and available credentials, the payload could read or alter sour ...[truncated 269 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer the documented WinGet installation method and verify the expected package identity, publisher, source, and version.
• Do not pipe downloaded content directly into Invoke-Expression.
• If a script-based installer is necessary, download it to a local file first.
• Pin the installer to a specific release and verify it against an independently published cryptographic hash or trusted digital signature.
• Permit users to inspect the verified script before execution.
• Run installation with the lowest privileges required and avoid elevated PowerShell unless explicitly necessary.
• Document the expected download domain, signer, digest, and verification failure behavior.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:212

Finding

Unpinned npm Package Is Executed Without Confirmation During MCP Setup

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:212
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

powershell

# stdio mode
claude mcp add server-name --transport stdio -- env VAR=value -- npx -y mcp-server

Technical Analysis

The MCP setup example invokes npx -y with the generic, unversioned package name mcp-server. The -y option suppresses interactive confirmation, while the absence of an exact package version and integrity lock allows package contents to change between review and execution.

npm packages and their lifecycle or runtime code can execute with the current user's privileges. A compromised package release, package ownership transfer, dependency compromise, or unexpected package resolution could therefore introduce attacker-controlled code. Registering the resulting process as an MCP server may additionally expose whatever data, environment variables, filesystem paths, or tool capabilities are granted through its configuration.

MCP integration is within the Skill's stated purpose, but executing an unspecified and unpinned package is not necessary. A concrete, verified package and exact version should be required.

Attack Path

1. An attacker publishes or compromises the package resolved as mcp-server, one of its dependencies, or a later unpinned release.
2. A user copies the documented MCP registration command.
3. npx -y resolves and downloads the package without asking the user to confirm installation.
4. npm lifecycle code or the package executable runs under the user's account.
5. The malicious package accesses locally available data or credentials and may operate through the MCP trust relationship and granted capabilities.

Impact Assessment

Exploitation can result in arbitrary code execution with the invoking user's privileges. Potential scope includes access to environment variables such as config ...[truncated 272 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the placeholder with a specific, officially documented package from a verified publisher.
• Pin the package to an exact reviewed version, for example verified-package@1.2.3, rather than resolving the latest release.
• Verify package provenance, registry source, signatures or attestations where available, and integrity metadata.
• Use a lockfile or equivalent integrity-controlled installation process before MCP registration.
• Avoid -y so that unexpected installation or resolution remains visible to the operator.
• Review lifecycle scripts and disable them during installation where practical, enabling only those explicitly required.
• Run the MCP server in a restricted environment with narrowly scoped filesystem, environment-variable, network, and tool access.
• Document the exact capabilities the MCP server needs and deny all other permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented pipe examples send log contents and git-derived data directly into Claude Code, but the skill does not warn that this may transmit sensitive local content to an external model provider. Logs, filenames, diffs, and code context commonly contain secrets, internal paths, customer data, or proprietary source that could be exposed outside the local trust boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs Claude Code to create commits, branches, and PRs but does not clearly warn that these actions modify repository state and may publish code or metadata to remote services. In an agentic setting, users may treat these as routine analysis steps and unintentionally authorize irreversible or externally visible changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill recommends installing/running an MCP server via npx -y mcp-server without pinning a specific package name and version. That creates a supply-chain risk: a later package update, typo-squatted dependency, or compromised upstream release could execute arbitrary code in the local environment when the command is run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The third-party provider section shows credential placement and direct API testing but lacks clear secure-secret-handling guidance. Users may paste real API keys into persistent config files, shell history, examples, screenshots, or shared environments, increasing the risk of credential leakage and unauthorized API use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.