Security audit

Gstack Openclaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly documentation, but it has unsafe and inconsistent install guidance plus subskills that describe automatic production changes without clear approval gates.

Install only through ClawHub or by copying reviewed markdown files. Do not run the SKILL.md manual git clone plus ./install.sh command. Treat production deploy, rollback, PR merge, browser-login, and auto-fix modes as needing explicit review, scoped credentials, and human approval before they touch real systems or source files.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:76
Finding: Unpinned Remote Installer Retrieval and Execution
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:76-78
Vulnerability Type: Remote payload retrieval followed by local execution
Risk Level: High

Vulnerable Code

bash
git clone https://github.com/openclaw/gstack-openclaw ~/.openclaw/skills/gstack cd ~/.openclaw/skills/gstack && ./install.sh

Technical Analysis

The installation instructions clone the current state of a remote repository and immediately execute install.sh without pinning the repository to a reviewed commit or verifying the script's integrity.

The audited project does not contain install.sh. This instruction therefore also contradicts the claims in SKILL.md and SECURITY.md that the installer was removed and that the project is documentation-only.

Because the remote branch is mutable, the code executed by a future user can differ from the content reviewed during this audit. A compromised repository, malicious maintainer update, account takeover, DNS or transport trust failure, or repository substitution could introduce an installer that executes arbitrary commands.

Attack Path

An attacker compromises or gains write access to the referenced repository, or otherwise causes users to retrieve substituted repository content.

The attacker adds a malicious install.sh to the default branch.

A user follows the installation instructions in SKILL.md.

git clone retrieves the attacker's current payload.

The shell immediately executes install.sh under the user's account.

The payload can access files and credentials available to that account, modify the OpenClaw environment, install persistence, or retrieve additional payloads.

Impact Assessment

Successful exploitation provides arbitrary command execution with the privileges of the user performing the installation. The accessible scope can include the user's home directory, source repositories, SSH configuration, development credentials, ...[truncated 146 chars]
Remediation: View remediation
Remediation Suggestions

Remove the obsolete ./install.sh instruction.

Make SKILL.md, README.md, and SECURITY.md use one consistent installation procedure.

For manual installation, copy only the reviewed Markdown files rather than executing repository-provided scripts.

If remote retrieval is unavoidable, pin the repository to a specific reviewed commit and verify a published cryptographic checksum or signature.

Never combine remote retrieval and execution in a single copy-and-paste command.

Add an automated documentation test that rejects references to missing executable files.

T08 · Insecure Dependencies

Warning

Location: _skills/docs/SKILL.md:496
Finding: Unverified and Unpinned Global npm Package Installation
Content: View full analysis
Vulnerability Details

File Location: _skills/docs/SKILL.md:496-503
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
npm install -g @imaclaw/cli

bash
imaclaw generate "Early autumn outfit sharing" --platform xiaohongshu

Technical Analysis

The documentation-generation example recommends installing @imaclaw/cli globally without a fixed version, integrity verification, provenance validation, or evidence in the audited project that this package is trusted and maintained.

npm installation can execute package lifecycle scripts. Global installation also places executables in a shared user-level or system-level command path, increasing the effect of a malicious or compromised package. Presenting the package as a copy-and-paste runnable example may cause users or agents to install it even if it was intended only as hypothetical documentation.

A similar but established tool installation appears at _skills/benchmark/SKILL.md:317-320:

bash
npm install -g @lhci/cli lhci autorun

That example has the same unpinned global-install weakness, although the package name is directly relevant to the benchmark skill.

Attack Path

A generated README or skill response reproduces the global npm installation command.

A user executes the command.

npm resolves the package's mutable latest version from the configured registry.

A compromised release, malicious package, registry substitution, or dependency compromise supplies hostile code.

npm executes lifecycle scripts and installs a command into the user's global executable path.

The package can access files and credentials available to the npm process and can execute again when the installed command is invoked.

Impact Assessment

Exploitation can result in arbitrary code execution with the privileges of the user running npm. Potentially exposed ass ...[truncated 219 chars]
Remediation: View remediation
Remediation Suggestions

Do not present hypothetical packages as verified, runnable dependencies.

Clearly label fictional package names and commands as pseudocode.

Prefer project-local, development-only installation over global installation.

Pin approved packages to a reviewed version.

Use package-lock integrity metadata and verify package provenance before installation.

Run third-party tools in a constrained environment without production credentials.

Add an explicit warning that npm lifecycle scripts may execute during installation.

Apply the same version-pinning and local-install controls to the Lighthouse CI example.

T05 · Unauthorized Access and Privilege Escalation

Error

Location: _skills/canary/SKILL.md:222
Finding: Autonomous Production Rollback Without an Explicit Approval Boundary
Content: View full analysis
Vulnerability Details

File Location: _skills/canary/SKILL.md:222-229
Vulnerability Type: Excessive production-change authority
Risk Level: High

Vulnerable Code

markdown
### Automatic Decision **Rollback trigger condition**: - P95 latency is greater than 150% of the baseline **Decision**: Extend monitoring for five minutes. If there is no improvement within five minutes, rollback will occur automatically.

The same behavior is reinforced at _skills/canary/SKILL.md:68-74:

text
Decision at each phase: ├── Metrics normal → advance to the next phase ├── Metrics warning → extend the monitoring period └── Metrics dangerous → automatic rollback

Technical Analysis

The canary skill authorizes a production-changing rollback based on telemetry without requiring explicit approval immediately before the destructive action. Although rollback is relevant to canary deployment management, automatically granting the agent production mutation authority exceeds the minimum privilege needed to analyze metrics and recommend a response.

The documented example also contains inconsistent threshold reasoning. It reports a P95 latency change of +121% while describing the trigger as exceeding 150%, increasing the risk that ambiguous percentage calculations will cause an incorrect rollback decision.

Monitoring input can be noisy, stale, incomplete, or attacker-influenced. A single decision path that converts such input directly into a production rollback lacks separation of duties and a reliable authorization boundary.

Attack Path

An attacker, faulty deployment, instrumentation error, or transient traffic spike influences canary metrics.

The skill evaluates the metrics using an ambiguous or incorrectly implemented threshold.

The skill decides that the canary remains unhealthy after the monitoring window.

Without obtaining explicit per-action approval, the workflow in ...[truncated 633 chars]
Remediation: View remediation
Remediation Suggestions

Default the skill to analysis and recommendation only.

Require explicit user approval immediately before changing traffic or initiating a rollback.

Use short-lived, narrowly scoped deployment credentials rather than general production credentials.

Separate metric analysis from rollback execution through an approval-controlled deployment system.

Display the exact target environment, current version, rollback version, commands, and expected effects before approval.

Validate sample size, metric freshness, statistical significance, and telemetry source integrity.

Define percentage thresholds unambiguously and add automated tests for all boundary conditions.

Provide a dry-run mode and preserve an immutable audit log of decisions and approvals.

Check database and schema backward compatibility before allowing rollback.

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: _skills/review/SKILL.md:373
Finding: Silent Source-Code Modification During Review
Content: View full analysis
Vulnerability Details

File Location: _skills/review/SKILL.md:373-384
Vulnerability Type: Unapproved file modification
Risk Level: Medium

Vulnerable Code

markdown
## Auto-fix ### Automatic Fix Scope **Fixes marked [AUTO-FIXED] require no human confirmation**: - Code formatting issues that Prettier or ESLint can fix - Simple naming conventions such as variable capitalization - Missing semicolons or commas - Simple type annotation additions - Removal of unused imports **Fixes marked [AUTO-FIX-SUGGESTED] require human confirmation**: - Simple refactoring such as extracting a function - Obvious logic errors such as spelling mistakes - Better standard-library alternatives

Technical Analysis

The review skill explicitly permits source-code changes without human confirmation. This conflicts with the project's documentation-only and non-modifying security posture.

The listed operations are not uniformly non-semantic. Renaming identifiers, adding type annotations, and deleting imports can alter runtime behavior, module initialization side effects, generated interfaces, reflection behavior, or build output. Tool configuration can also cause an apparently simple formatter or linter invocation to apply broader changes than intended.

Automatically modifying files is not necessary to provide a code-review report. Recommendation-only behavior would satisfy the declared review functionality with lower privileges.

Attack Path

A user invokes the review skill on a writable project.

The skill or an associated tool classifies a proposed change as automatically fixable.

The skill edits source files without presenting a diff or requesting approval.

A removed import, renamed identifier, type change, or tool-driven rewrite changes program behavior or breaks the build.

The unreviewed change may later be committed or deployed through the documented automated workflow.

...[truncated 356 chars]
Remediation: View remediation
Remediation Suggestions

Make review mode read-only by default.

Require explicit user approval before every file modification, or require the user to opt into a clearly scoped auto-fix mode.

Present a complete diff before applying changes.

Restrict auto-fixes to user-selected files and prevent writes outside the project root.

Run formatting and linting tools with pinned configurations and trusted plugins.

Execute tests, type checking, and linting after changes and report failures.

Keep backups or use a temporary branch so changes can be reverted safely.

Do not automatically commit, push, merge, or deploy modified files.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (55)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
md
- `SKILL.md` — 本文件（主技能描述）

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README's instructional content is written entirely in Chinese, including the usage examples and operational guidance, with no indication that the skill is China-specific or that other languages are supported. This can violate language/locale policy expectations because users are not given an opt-in or alternative language path.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 72)May include surrounding context.
git clone https://github.com/openclaw/gstack-openclaw ~/.openclaw/skills/gstack

2. 复制技能文件

mkdir -p ~/.openclaw/skills/gstack cp ~/.openclaw/skills/gstack/SKILL.md ~/.openclaw/skills/gstack/

text

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 73)May include surrounding context.
2. 复制技能文件

mkdir -p ~/.openclaw/skills/gstack cp ~/.openclaw/skills/gstack/SKILL.md ~/.openclaw/skills/gstack/

text
### 验证安装

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SECURITY.md (reported line 55)May include surrounding context.
✅ 手动安装

bash
mkdir -p ~/.openclaw/skills/gstack cp SKILL.md ~/.openclaw/skills/gstack/

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The metadata says install.sh was removed to eliminate suspicious warnings, but the same file still tells users to execute install.sh. This is a strong integrity issue: users are reassured by a safety claim while being directed toward behavior that contradicts it, increasing the chance of unsafe script execution.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document explicitly claims there is no install script, yet later instructs users to run ./install.sh. This contradiction undermines trust and can mislead users into executing a local shell script under false safety assurances, which is dangerous because shell scripts can make arbitrary system changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The installation instructions direct users to clone a repository and execute a shell script without any warning, review step, or description of system changes. Even in documentation-only content, encouraging blind script execution is risky because it normalizes running untrusted code with the user's privileges.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 文件描述与全文指令均以中文明确设定技能行为，但没有给出用户可选择语言的选项，也未说明这是仅面向中文场景的受限技能。根据规则，未获用户选择即强制特定语言属于自然语言策略违规。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The RUM example posts Web Vitals telemetry to an analytics endpoint without any guidance on consent, minimization, retention, or disclosure. Even though the sample only shows performance metrics, such client-side telemetry can still become user/session-linked when combined with IPs, cookies, request metadata, or backend logs, creating privacy and compliance risk if copied into production unchanged.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly includes login-flow testing and demonstrates reading a token from localStorage after authentication, but it does not warn users that browser automation may handle real credentials or access session artifacts. In a testing skill, this creates a meaningful risk of unintended exposure of authentication data, especially if users run it against production systems or with real accounts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill description and examples are written only in Chinese, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill advertises automatic rollback and release decision behavior without prominently warning that these actions can affect production availability and traffic routing. In an agent setting, this can normalize autonomous service-impacting actions without requiring confirmation, increasing the risk of unintended operational changes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The anomaly report contains a logic contradiction between the stated rollback trigger and the resulting action, which can cause operators or an autonomous agent to make the wrong deployment decision under incident conditions. In a live canary context, inconsistent decision criteria increase the chance of delaying a needed rollback or continuing a bad release, causing avoidable production impact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The auto-trigger example depicts the system making live rollback decisions after autonomous monitoring, but it does not include any safeguard language about confirmation, blast radius, or production consequences. This is dangerous because users may copy the pattern into real workflows and allow an agent to take disruptive actions based on incomplete or noisy telemetry.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill encourages generation of CI/CD workflows and Kubernetes deployment manifests that can directly affect staging and production environments, but it does not prominently warn users that the output may perform real deployment, rollout, scaling, or rollback actions. In an agent-skill context, omission of this warning increases the chance that users copy or apply generated configs without adequate review, causing accidental production-impacting changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file is entirely framed in Chinese, including the description, usage examples, and operating instructions, but it does not tell users they may choose another language or that the skill is intended only for a Chinese-language context. Under the policy rule for natural-language violations, forcing a specific language without opt-in is a reportable issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description is entirely in Chinese and presents the skill as a general-purpose documentation engineer, but nowhere in the file does it state that Chinese is optional or that the skill is region-specific. For a broadly applicable docs skill, this can amount to an implicit locale policy violation because it steers usage toward a fixed language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown skill description consistently presents instructions, examples, and behavior in Chinese, while the file does not state that the skill is region-specific or provide an opt-in language selection. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill content is written entirely in Chinese with no language-selection mechanism or explicit locale restriction, which can prevent non-Chinese-speaking users or reviewers from understanding its behavior, limitations, and safety-relevant instructions. In a security review context, reduced comprehensibility increases the risk of misuse, missed unsafe behavior, and inadequate oversight, even though the content itself appears to be a benign project scaffolding guide.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description and the main body present the skill entirely in Chinese, which constitutes a language-specific constraint in natural-language instructions. The file does not offer an opt-in choice of language or explain that the skill is limited to a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · _skills/investigate/SKILL.md (reported line 327)May include surrounding context.
md
> ### 第 2 步: 假设 1 - 网络问题 > **验证**: 测试到 Stripe API 的网络连通性 > ```bash > curl -I https://api.stripe.com/v1/charges > ``` > **结果**: ✅ 网络正常，响应 200ms >

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is explicitly designed to merge PRs, deploy to production, and roll back changes, but it does not require a prominent user confirmation or safety warning before performing production-affecting actions. In an agent setting, this increases the risk of accidental or overly broad execution against live systems, especially if the agent interprets a casual request as authorization to act.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · _skills/docs/SKILL.md (reported line 179)May include surrounding context.
bash
# 1. 基础可用性检查 curl -sf https://api.example.com/health || exit 1 # 2. 核心功能检查 curl -sf https://api.example.com/api/users/me || exit 1

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · _skills/docs/SKILL.md (reported line 187)May include surrounding context.
bash
# 1. 基础可用性检查 curl -sf https://api.example.com/health || exit 1 # 2. 核心功能检查 curl -sf https://api.example.com/api/users/me || exit 1

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: _skills/browse/SKILL.md:147

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: _skills/review/SKILL.md:252

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: _skills/security/SKILL.md:94

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: _skills/test/SKILL.md:304

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Ae1

Natural-Language Policy Violations

Session Persistence

2. 复制技能文件

Skill Enumeration

2. 复制技能文件

Session Persistence

✅ 手动安装

Intent-Code Divergence

Intent-Code Divergence

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

External Transmission

Missing User Warnings

External Transmission

External Transmission

Static analysis

File appears to expose a hardcoded API secret or token.

File appears to expose a hardcoded API secret or token.

File appears to expose a hardcoded API secret or token.

File appears to expose a hardcoded API secret or token.