ClawHub
Back to skill

Security audit

AI Shield — OpenClaw Security Audit

Security checks for vulnerabilities and agentic risk

Overview

This is a local OpenClaw config auditing tool, but its sanitizer is advertised for sharing while using incomplete redaction rules that can leave secrets behind.

Install only if you treat it as a local heuristic audit aid. Do not assume its sanitize command makes a config safe to share; manually review sanitized output and avoid sharing live OpenClaw configs that may contain tokens, gateway credentials, cookies, or private keys.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
src/audit.js:341
Finding

Secret leakage audit skips nested and nonstandard configuration locations

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
src/sanitize.js:11
Finding

Sanitizer can preserve common credentials in output represented as safe to share

Content
View full analysis
deepSanitize(item, [...path, String(i)])); } if (typeof obj === 'object') { const result = {}; for (const [key, val] of Object.entries(obj)) { result[key] = deepSanitize(val, [...path, key]); } return result; } if (typeof obj === 'string') { const currentKey = path[path.length - 1] || ''; // Check if key name suggests a secret if (SECRET_KEY_PATTERNS.some(p => p.test(currentKey))) { return REDACTED; } // Check if value looks like a secret if (SECRET_VALUE_PATTERNS.some(p => p.test(obj))) { return REDACTED; } // Redact env sections aggressively if (path.includes('env') && obj.length > 20) { return REDACTED; } } return obj; } ``` ### Technical Analysis The recursive traversal is structurally sound, but its redaction decision is limited to: - A small set of secret-related key suffixes. - A small set of anchored credential formats. - Strings longer tha ...[truncated 2410 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill description says it performs security auditing, but the documented behavior also includes sanitization/redaction and direct access to ~/.openclaw/openclaw.json, which are materially different capabilities. This mismatch can mislead users and orchestrators into granting or invoking broader file access than expected, especially because OpenClaw configs may contain tokens, secrets, and sensitive topology data.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill description says it performs security auditing, but the documented behavior also includes sanitization/redaction and direct access to ~/.openclaw/openclaw.json, which are materially different capabilities. This mismatch can mislead users and orchestrators into granting or invoking broader file access than expected, especially because OpenClaw configs may contain tokens, secrets, and sensitive topology data.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/audit.js (reported line 335)May include surrounding context.

js
{ pattern: /\b[0-9]+:[A-Za-z0-9_-]{35,}\b/, type: 'Telegram bot token' },
    { pattern: /0x[a-fA-F0-9]{64}/i, type: 'Private key (hex 256-bit)' },
    { pattern: /xai-[a-zA-Z0-9]{20,}/i, type: 'xAI API key' },
    { pattern: /ghp_[a-zA-Z0-9]{36,}/i, type: 'GitHub personal access token' },
    { pattern: /gho_[a-zA-Z0-9]{36,}/i, type: 'GitHub OAuth token' },
    { pattern: /glpat-[a-zA-Z0-9_-]{20,}/i, type: 'GitLab personal access token' },
    { pattern: /AKIA[0-9A-Z]{16}/i, type: 'AWS access key' },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/audit.js (reported line 337)May include surrounding context.

js
{ pattern: /\b[0-9]+:[A-Za-z0-9_-]{35,}\b/, type: 'Telegram bot token' },
    { pattern: /0x[a-fA-F0-9]{64}/i, type: 'Private key (hex 256-bit)' },
    { pattern: /xai-[a-zA-Z0-9]{20,}/i, type: 'xAI API key' },
    { pattern: /ghp_[a-zA-Z0-9]{36,}/i, type: 'GitHub personal access token' },
    { pattern: /gho_[a-zA-Z0-9]{36,}/i, type: 'GitHub OAuth token' },
    { pattern: /glpat-[a-zA-Z0-9_-]{20,}/i, type: 'GitLab personal access token' },
    { pattern: /AKIA[0-9A-Z]{16}/i, type: 'AWS access key' },

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill instructs the agent to read a live user configuration file and references environment-capable execution, but it declares no explicit tool scope or permissions boundary. In a security-audit context this increases the chance of unnecessary access to sensitive local data such as secrets in config files or environment variables without clear user-visible limitation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
bin/shield.js:49