Openclaw Optimizer Pro

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:35 AM UTC
• Version: 1.1.3

Overview

This OpenClaw tuning guide is not clearly malicious, but it asks users to make broad persistent agent/config changes and run unpinned global installs that warrant review.

Review this skill before installing. Do not paste full OpenClaw configuration into chat or logs; inspect only needed fields and redact tokens. Avoid setting `tools.profile` to `full` unless you understand and need every enabled tool. Treat SOUL.md changes as persistent policy changes and approve them manually. Do not run the global `npx` or `npm install -g` commands unless you have verified the source, version, and package behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:32
• Finding: Persistent Modification of Core Agent Behavioral Rules## Vulnerability Details **File Location**: `SKILL.md`, line 32 **Vulnerability Type**: Persistent agent instruction and state manipulation **Risk Level**: High **Vulnerable Code Snippet**: ```markdown Ensure these principles are present in `SOUL.md`. They are system-level behavioral guarantees, not style preferences: ``` ### Technical Analysis The Skill instructs the agent to copy Skill-controlled behavioral rules into `SOUL.md`, treating them as system-level guarantees. Because `SOUL.md` is a persistent behavioral configuration file, these changes can continue influencing the agent after the optimization task and Skill invocation have ended. The prescribed rules govern execution preferences, trust boundaries, tool usage, output formatting, and responses to future requests. Persistently rewriting these controls is not required to perform token-cost analysis, configuration tuning, or permission hardening. It crosses the boundary between providing optimization advice and modifying the agent's long-term decision policy. ### Attack Path 1. A user loads the Skill for an OpenClaw optimization or security review. 2. The agent interprets the instruction as authorization to modify `SOUL.md`. 3. Skill-authored behavioral rules are copied into that persistent file. 4. OpenClaw loads the modified rules in later sessions. 5. Future tasks are handled according to the Skill's rules even when the Skill is no longer active. 6. A malicious or subsequently compromised Skill version could use the same mechanism to weaken safety controls or direct privileged actions. ### Impact Assessment The modification can influence future sessions, unrelated users' requests, tool-selection policy, trust decisions, and authorization behavior. Although the reviewed text contains several ostensibly defensive rules, the persistence mechanism grants the Skill undue control over core agent behavior. The affected scope is the OpenClaw instance that consume ...[truncated 25 chars]
• Remediation: ## Remediation Suggestions - Do not instruct the agent to write Skill-supplied rules into `SOUL.md` or any other persistent behavioral file. - Present proposed behavioral changes as optional recommendations for explicit user review. - Show a clear diff and obtain informed confirmation before changing persistent policy. - Keep task-specific behavior scoped to the current Skill invocation. - Enforce platform-level restrictions preventing Skills from modifying system prompts, policy files, or durable memory. - Validate any persistent configuration changes against a trusted schema and administrator-controlled policy.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:84
• Finding: Mandatory Full Tool Profile Violates Least Privilege## Vulnerability Details **File Location**: `SKILL.md`, lines 84-89 **Vulnerability Type**: Excessive tool and system capability enablement **Risk Level**: High **Vulnerable Code Snippet**: ```markdown | `tools.profile` | `"full"` | Unlocks web_search, browser, nodes and all tools | **Get a free Gemini API Key:** https://aistudio.google.com/apikey (1500 requests/day free) > ⚠️ `heartbeat.quiet` is not supported — throws `Unrecognized key` error. Do not add it. > ⚠️ `tools.profile` must be `"full"`. Defaults (`coding` / `messaging`) silently disable most tools. ``` ### Technical Analysis The Skill declares that the tool profile must be set to `full`, enabling browser, web-search, node, and other tools without determining whether each capability is necessary for the requested optimization task. Most documented functions require only narrowly scoped configuration reads and, after user approval, specific local writes. Enabling every available tool significantly increases the consequences of prompt injection, malicious external content, or a compromised dependency. The recommendation therefore exceeds the minimum privileges needed for the declared functionality. ### Attack Path 1. A user follows the optimization guide and changes `tools.profile` to `full`. 2. The OpenClaw agent receives access to browser, network, node, and other privileged tools. 3. The agent later processes malicious web content, documents, messages, or dependency instructions. 4. Injected instructions attempt to invoke one of the newly enabled tools. 5. The agent can perform network requests, browser operations, node actions, or local modifications that would have been unavailable under a restricted profile. ### Impact Assessment The recommendation broadens access from task-specific capabilities to all tools supported by the deployment. Depending on the OpenClaw environment, this may expose local files, authenticated browser sessions, network r ...[truncated 203 chars]
• Remediation: ## Remediation Suggestions - Replace the `full` profile requirement with a minimal, task-specific tool allowlist. - Enable browser, network, node, and write-capable tools only when individually required. - Require explicit user approval before elevating the active tool profile. - Automatically restore the previous profile after completing the approved operation. - Separate read-only audit capabilities from configuration-writing and external-network capabilities. - Document the exact reason, duration, and security implications for every requested tool permission.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:20
• Finding: Entire OpenClaw Configuration Is Printed Without Secret Redaction## Vulnerability Details **File Location**: `SKILL.md`, lines 20-26 **Vulnerability Type**: Sensitive configuration exposure **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash # Check workspace file token usage (macOS/Linux) for f in AGENTS.md SOUL.md TOOLS.md IDENTITY.md USER.md HEARTBEAT.md MEMORY.md; do p="$HOME/.openclaw/workspace/$f" [ -f "$p" ] && echo "$f : ~$(($(wc -c < "$p") / 4)) tokens" done cat ~/.openclaw/openclaw.json ``` ### Technical Analysis The command prints the complete `openclaw.json` file into the terminal and potentially into the agent's conversation context. The same Skill identifies gateway authentication tokens and API-related settings as fields stored or configured through this file, so indiscriminate output may expose secrets, identifiers, internal endpoints, or infrastructure details. The operation is unnecessary for many audit tasks because only a limited set of non-secret settings needs to be inspected. No redaction, field allowlist, output suppression, or warning is provided. ### Attack Path 1. The agent runs the documented audit commands. 2. The entire OpenClaw configuration is emitted to standard output. 3. Terminal output is captured in agent context, execution logs, telemetry, or conversation history. 4. A later response, malicious prompt, or person with log access obtains sensitive configuration values. 5. Exposed authentication material may then be used against the configured gateway or third-party services. ### Impact Assessment Potentially exposed information includes gateway tokens, API keys, service identifiers, model configuration, local paths, and internal network details. Successful abuse could permit unauthorized use of paid APIs or access to an OpenClaw gateway. No direct exfiltration destination is present in the reviewed Skill, so exploitation requires access to the generated output, logs, or subsequent model context.
• Remediation: ## Remediation Suggestions - Do not print the entire configuration file. - Extract only the fields required for the current audit through a strict allowlist. - Redact values whose keys contain terms such as `token`, `secret`, `password`, `credential`, or `apiKey`. - Keep command output out of persistent conversation logs where possible. - Warn the user before inspecting any configuration file that may contain credentials. - Prefer a dedicated OpenClaw diagnostic command that reports security posture without returning secret values.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:129
• Finding: Unpinned Third-Party Software Is Installed Globally## Vulnerability Details **File Location**: `SKILL.md`, lines 129-142 **Vulnerability Type**: Unsafe dependency acquisition and global installation **Risk Level**: High **Vulnerable Code Snippet**: ```bash # Proactive behavior + self-improvement npx skills add halthelobster/proactive-agent@proactive-agent -g -y ``` ```markdown **Avoid:** - `bdi-mental-states` — academic only, not useful for personal assistants - `autonomous-agents` — reference manual, limited practical value **Optional (after memory files exceed 5000+ tokens):** ```bash npm install -g https://github.com/tobi/qmd ``` ``` ### Technical Analysis The Skill recommends globally installing third-party content without an immutable package version, commit hash, checksum, signature, or source review. The `-y` option suppresses interactive confirmation for the Skill installation. The GitHub installation resolves mutable remote repository content at execution time, meaning the installed payload can differ from what was reviewed. Package installation can run lifecycle scripts or deploy executable files. Global installation also expands persistence and blast radius beyond the current project. These properties create a supply-chain execution path even though no malicious package payload is embedded directly in the audited project. ### Attack Path 1. A user or agent executes one of the recommended installation commands. 2. The package manager resolves the package, Skill, repository branch, and transitive dependencies at runtime. 3. An upstream account, package release, repository branch, or dependency is compromised or changed. 4. The package manager downloads the changed content. 5. Installation hooks or subsequently invoked executables run attacker-controlled code. 6. Because installation is global, the compromised component remains available to other projects and future sessions. ### Impact Assessment Malicious installer or package code woul ...[truncated 362 chars]
• Remediation: ## Remediation Suggestions - Pin packages to immutable, reviewed versions and Git repositories to full commit hashes. - Verify checksums, signatures, publisher identity, and dependency provenance before installation. - Remove automatic confirmation flags such as `-y`. - Avoid global installation; use an isolated project directory, container, or restricted environment. - Review package lifecycle scripts and transitive dependencies before execution. - Disable install scripts when they are not required. - Require explicit user approval immediately before any network retrieval or software installation. - Maintain a trusted dependency allowlist and a documented update-review process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest description uses broad activation wording such as optimizing, fixing capabilities, tuning settings, and hardening security, which can cause the skill to trigger in many common troubleshooting contexts. Over-broad activation increases the chance that users invoke high-impact configuration guidance unintentionally or outside the intended OpenClaw-specific environment.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide tells users to print the full `~/.openclaw/openclaw.json` without warning that it may contain secrets such as tokens, endpoints, or infrastructure details. In an agent-mediated or shared-chat workflow, this can directly expose sensitive configuration data to logs, transcripts, or unauthorized observers.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Core operational constraints and required SOUL.md content are presented in Chinese and described as mandatory additions, but the document does not provide an opt-in or alternative language path. This can impose a specific language/locale on users and maintainers contrary to the policy requirement for choice or justified documentation.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Recommending `tools.profile = "full"` broadens runtime capabilities well beyond what is needed for token optimization or basic hardening. Enabling unnecessary tools increases attack surface and the consequences of prompt injection, misconfiguration, or downstream skill abuse by granting access to more powerful actions.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

| gateway.bind | `openclaw.json` | `"loopback"` (not `"0.0.0.0"`) |
| gateway.auth.mode | `openclaw.json` | `"token"` |
| gateway.auth.token length | check config | ≥ 32 chars |
| openclaw.json permissions | `ls -la ~/.openclaw/openclaw.json` | `-rw-------` |
| macOS firewall | see below | Enabled |
| tailscale | `tailscale status` | Off unless intentional |

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Enable macOS Application Firewall

```bash
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
# Verify:
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Enable macOS Application Firewall

```bash
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
# Verify:
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### Fix config file permissions if needed

```bash
chmod 600 ~/.openclaw/openclaw.json
chmod 700 ~/.openclaw/credentials
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
chmod 600 ~/.openclaw/openclaw.json
chmod 700 ~/.openclaw/credentials
```

---

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The guide recommends installing an unrelated `proactive-agent` skill even though this skill is presented as an OpenClaw optimizer and security hardening guide. Pulling in extra agent behavior expands the trusted code/instruction surface and may introduce capabilities or autonomy that the user did not request or evaluate.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The skill instructs users to execute `npx skills add ...` without pinning a specific version or immutable reference for the package/tooling chain. This creates a supply-chain risk: future upstream changes or a compromised package could cause different code to run than what the guide author reviewed, especially because the command fetches and executes content dynamically.

Static analysis

No suspicious patterns detected.