other
Warning
- Location
SKILL.md:14- Finding
Broad Environment Reconnaissance and Sensitive Resource Access
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Doctor
Security checks for vulnerabilities and agentic risk
Overview
This OpenClaw health-check skill is coherent, but it can inspect sensitive configuration, credential status, cron, and memory-related files with broad automatic activation.
Install only if you want an agent to perform OpenClaw diagnostics over local configuration, model/auth status, cron status, and memory/workspace files. Before running it, confirm that reports are shown only to the system owner or administrator, and prefer adding explicit confirmation plus stricter redaction/allowlisting for openclaw.json, cron output, MEMORY.md, TOOLS.md, and API-key checks.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The feature list states the skill checks model connectivity, API key status, configuration files, and memory artifacts, but it does not warn users that sensitive configuration metadata may be inspected. Even if values are not directly exposed, a diagnostic tool that probes API key presence/status and system config can reveal secrets-adjacent information or normalize access to sensitive files without informed consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README says the AI will automatically invoke the skill when needed and also advertises a very broad trigger phrase ('检查系统状态'). For a diagnostic skill that inspects configuration, model connectivity, cron jobs, and memory files, this ambiguity can cause the agent to run the skill in contexts the user did not clearly intend, leading to unnecessary inspection of sensitive system metadata.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill content, including the description, headings, usage instructions, and output template, is entirely in Chinese and does not indicate that the user can choose another language. This can violate a language/locale policy when a skill implicitly forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
All user-facing natural-language description and the example trigger phrase are presented only in Chinese, with no indication that another language can be used or selected. This may violate a language/locale policy when a skill implicitly requires a specific language without user opt-in.
- Content
Static analysis
No suspicious patterns detected.