Openclaw Optimizer Pro

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:35 AM UTC
• Version: 1.1.3

Overview

This OpenClaw tuning guide is not clearly malicious, but it asks users to make broad persistent agent/config changes and run unpinned global installs that warrant review.

Review this skill before installing. Do not paste full OpenClaw configuration into chat or logs; inspect only needed fields and redact tokens. Avoid setting `tools.profile` to `full` unless you understand and need every enabled tool. Treat SOUL.md changes as persistent policy changes and approve them manually. Do not run the global `npx` or `npm install -g` commands unless you have verified the source, version, and package behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:32

Finding

Persistent Modification of Core Agent Behavioral Rules

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 32
Vulnerability Type: Persistent agent instruction and state manipulation
Risk Level: High

Vulnerable Code Snippet:

markdown

Ensure these principles are present in `SOUL.md`. They are system-level behavioral guarantees, not style preferences:

Technical Analysis

The Skill instructs the agent to copy Skill-controlled behavioral rules into SOUL.md, treating them as system-level guarantees. Because SOUL.md is a persistent behavioral configuration file, these changes can continue influencing the agent after the optimization task and Skill invocation have ended.

The prescribed rules govern execution preferences, trust boundaries, tool usage, output formatting, and responses to future requests. Persistently rewriting these controls is not required to perform token-cost analysis, configuration tuning, or permission hardening. It crosses the boundary between providing optimization advice and modifying the agent's long-term decision policy.

Attack Path

1. A user loads the Skill for an OpenClaw optimization or security review.
2. The agent interprets the instruction as authorization to modify SOUL.md.
3. Skill-authored behavioral rules are copied into that persistent file.
4. OpenClaw loads the modified rules in later sessions.
5. Future tasks are handled according to the Skill's rules even when the Skill is no longer active.
6. A malicious or subsequently compromised Skill version could use the same mechanism to weaken safety controls or direct privileged actions.

Impact Assessment

The modification can influence future sessions, unrelated users' requests, tool-selection policy, trust decisions, and authorization behavior. Although the reviewed text contains several ostensibly defensive rules, the persistence mechanism grants the Skill undue control over core agent behavior. The affected scope is the OpenClaw instance that consume ...[truncated 25 chars]

Remediation

View remediation

Remediation Suggestions

• Do not instruct the agent to write Skill-supplied rules into SOUL.md or any other persistent behavioral file.
• Present proposed behavioral changes as optional recommendations for explicit user review.
• Show a clear diff and obtain informed confirmation before changing persistent policy.
• Keep task-specific behavior scoped to the current Skill invocation.
• Enforce platform-level restrictions preventing Skills from modifying system prompts, policy files, or durable memory.
• Validate any persistent configuration changes against a trusted schema and administrator-controlled policy.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:84

Finding

Mandatory Full Tool Profile Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 84-89
Vulnerability Type: Excessive tool and system capability enablement
Risk Level: High

Vulnerable Code Snippet:

markdown

| `tools.profile` | `"full"` | Unlocks web_search, browser, nodes and all tools |

**Get a free Gemini API Key:** https://aistudio.google.com/apikey (1500 requests/day free)

> ⚠️ `heartbeat.quiet` is not supported — throws `Unrecognized key` error. Do not add it.  
> ⚠️ `tools.profile` must be `"full"`. Defaults (`coding` / `messaging`) silently disable most tools.

Technical Analysis

The Skill declares that the tool profile must be set to full, enabling browser, web-search, node, and other tools without determining whether each capability is necessary for the requested optimization task. Most documented functions require only narrowly scoped configuration reads and, after user approval, specific local writes.

Enabling every available tool significantly increases the consequences of prompt injection, malicious external content, or a compromised dependency. The recommendation therefore exceeds the minimum privileges needed for the declared functionality.

Attack Path

1. A user follows the optimization guide and changes tools.profile to full.
2. The OpenClaw agent receives access to browser, network, node, and other privileged tools.
3. The agent later processes malicious web content, documents, messages, or dependency instructions.
4. Injected instructions attempt to invoke one of the newly enabled tools.
5. The agent can perform network requests, browser operations, node actions, or local modifications that would have been unavailable under a restricted profile.

Impact Assessment

The recommendation broadens access from task-specific capabilities to all tools supported by the deployment. Depending on the OpenClaw environment, this may expose local files, authenticated browser sessions, network r ...[truncated 203 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the full profile requirement with a minimal, task-specific tool allowlist.
• Enable browser, network, node, and write-capable tools only when individually required.
• Require explicit user approval before elevating the active tool profile.
• Automatically restore the previous profile after completing the approved operation.
• Separate read-only audit capabilities from configuration-writing and external-network capabilities.
• Document the exact reason, duration, and security implications for every requested tool permission.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:20

Finding

Entire OpenClaw Configuration Is Printed Without Secret Redaction

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-26
Vulnerability Type: Sensitive configuration exposure
Risk Level: Medium

Vulnerable Code Snippet:

bash

# Check workspace file token usage (macOS/Linux)
for f in AGENTS.md SOUL.md TOOLS.md IDENTITY.md USER.md HEARTBEAT.md MEMORY.md; do
  p="$HOME/.openclaw/workspace/$f"
  [ -f "$p" ] && echo "$f : ~$(($(wc -c < "$p") / 4)) tokens"
done
cat ~/.openclaw/openclaw.json

Technical Analysis

The command prints the complete openclaw.json file into the terminal and potentially into the agent's conversation context. The same Skill identifies gateway authentication tokens and API-related settings as fields stored or configured through this file, so indiscriminate output may expose secrets, identifiers, internal endpoints, or infrastructure details.

The operation is unnecessary for many audit tasks because only a limited set of non-secret settings needs to be inspected. No redaction, field allowlist, output suppression, or warning is provided.

Attack Path

1. The agent runs the documented audit commands.
2. The entire OpenClaw configuration is emitted to standard output.
3. Terminal output is captured in agent context, execution logs, telemetry, or conversation history.
4. A later response, malicious prompt, or person with log access obtains sensitive configuration values.
5. Exposed authentication material may then be used against the configured gateway or third-party services.

Impact Assessment

Potentially exposed information includes gateway tokens, API keys, service identifiers, model configuration, local paths, and internal network details. Successful abuse could permit unauthorized use of paid APIs or access to an OpenClaw gateway. No direct exfiltration destination is present in the reviewed Skill, so exploitation requires access to the generated output, logs, or subsequent model context.

Remediation

View remediation

Remediation Suggestions

• Do not print the entire configuration file.
• Extract only the fields required for the current audit through a strict allowlist.
• Redact values whose keys contain terms such as token, secret, password, credential, or apiKey.
• Keep command output out of persistent conversation logs where possible.
• Warn the user before inspecting any configuration file that may contain credentials.
• Prefer a dedicated OpenClaw diagnostic command that reports security posture without returning secret values.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:129

Finding

Unpinned Third-Party Software Is Installed Globally

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 129-142
Vulnerability Type: Unsafe dependency acquisition and global installation
Risk Level: High

Vulnerable Code Snippet:

bash

# Proactive behavior + self-improvement
npx skills add halthelobster/proactive-agent@proactive-agent -g -y

markdown

**Avoid:**
- `bdi-mental-states` — academic only, not useful for personal assistants
- `autonomous-agents` — reference manual, limited practical value

**Optional (after memory files exceed 5000+ tokens):**
```bash
npm install -g https://github.com/tobi/qmd

text

### Technical Analysis

The Skill recommends globally installing third-party content without an immutable package version, commit hash, checksum, signature, or source review. The `-y` option suppresses interactive confirmation for the Skill installation. The GitHub installation resolves mutable remote repository content at execution time, meaning the installed payload can differ from what was reviewed.

Package installation can run lifecycle scripts or deploy executable files. Global installation also expands persistence and blast radius beyond the current project. These properties create a supply-chain execution path even though no malicious package payload is embedded directly in the audited project.

### Attack Path

1. A user or agent executes one of the recommended installation commands.
2. The package manager resolves the package, Skill, repository branch, and transitive dependencies at runtime.
3. An upstream account, package release, repository branch, or dependency is compromised or changed.
4. The package manager downloads the changed content.
5. Installation hooks or subsequently invoked executables run attacker-controlled code.
6. Because installation is global, the compromised component remains available to other projects and future sessions.

### Impact Assessment

Malicious installer or package code woul
...[truncated 362 chars]

Remediation

View remediation

Remediation Suggestions

• Pin packages to immutable, reviewed versions and Git repositories to full commit hashes.
• Verify checksums, signatures, publisher identity, and dependency provenance before installation.
• Remove automatic confirmation flags such as -y.
• Avoid global installation; use an isolated project directory, container, or restricted environment.
• Review package lifecycle scripts and transitive dependencies before execution.
• Disable install scripts when they are not required.
• Require explicit user approval immediately before any network retrieval or software installation.
• Maintain a trusted dependency allowlist and a documented update-review process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description uses broad activation wording such as optimizing, fixing capabilities, tuning settings, and hardening security, which can cause the skill to trigger in many common troubleshooting contexts. Over-broad activation increases the chance that users invoke high-impact configuration guidance unintentionally or outside the intended OpenClaw-specific environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide tells users to print the full ~/.openclaw/openclaw.json without warning that it may contain secrets such as tokens, endpoints, or infrastructure details. In an agent-mediated or shared-chat workflow, this can directly expose sensitive configuration data to logs, transcripts, or unauthorized observers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Core operational constraints and required SOUL.md content are presented in Chinese and described as mandatory additions, but the document does not provide an opt-in or alternative language path. This can impose a specific language/locale on users and maintainers contrary to the policy requirement for choice or justified documentation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Recommending tools.profile = "full" broadens runtime capabilities well beyond what is needed for token optimization or basic hardening. Enabling unnecessary tools increases attack surface and the consequences of prompt injection, misconfiguration, or downstream skill abuse by granting access to more powerful actions.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

| gateway.bind | `openclaw.json` | `"loopback"` (not `"0.0.0.0"`) |
| gateway.auth.mode | `openclaw.json` | `"token"` |
| gateway.auth.token length | check config | ≥ 32 chars |
| openclaw.json permissions | `ls -la ~/.openclaw/openclaw.json` | `-rw-------` |
| macOS firewall | see below | Enabled |
| tailscale | `tailscale status` | Off unless intentional |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

Enable macOS Application Firewall

bash

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
# Verify:
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

Enable macOS Application Firewall

bash

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
# Verify:
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

Fix config file permissions if needed

bash

chmod 600 ~/.openclaw/openclaw.json
chmod 700 ~/.openclaw/credentials

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

bash

chmod 600 ~/.openclaw/openclaw.json
chmod 700 ~/.openclaw/credentials

---

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide recommends installing an unrelated proactive-agent skill even though this skill is presented as an OpenClaw optimizer and security hardening guide. Pulling in extra agent behavior expands the trusted code/instruction surface and may introduce capabilities or autonomy that the user did not request or evaluate.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The skill instructs users to execute npx skills add ... without pinning a specific version or immutable reference for the package/tooling chain. This creates a supply-chain risk: future upstream changes or a compromised package could cause different code to run than what the guide author reviewed, especially because the command fetches and executes content dynamically.

Content

No source excerpt is available for this finding.