T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/apply.sh:74- Finding
Unnecessary Collection of System-Level Diagnostic Trace Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Cache Kit
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a local OpenClaw cost-optimization helper, but it changes core configuration and restarts the gateway with limited safeguards.
Review the script before running it on an important OpenClaw installation. It will persistently edit your OpenClaw config, enable local cache trace logs, change a model alias, and attempt a gateway restart; keep the generated backup and be prepared to restore it manually if the gateway does not restart cleanly.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/apply.sh:89- Finding
Gateway Restart Failure Is Masked and Configuration Changes Are Not Rolled Back
- Content
View full analysis
&1 || true log "✅ Gateway 재시작 완료 (또는 비대화형 환경에서는 수동 재시작 필요)" ``` The script subsequently ends with an unmatched shell command: ```bash PYEOF ``` ### Technical Analysis The script modifies `openclaw.json` before restarting the gateway. Although it creates a backup, it does not automatically restore that backup if validation or restart fails. The expression `openclaw gateway restart 2>&1 || true` suppresses every nonzero exit status from the restart operation. The following message therefore reports completion even when the gateway failed to restart. In addition, the standalone `PYEOF` at line 106 is outside the earlier heredoc and is interpreted by Bash as a command. Because the script uses `set -euo pipefail`, this nonexistent command normally causes the script to terminate with a nonzero status after the configuration has already been changed and after a potentially failed restart was reported as successful. This creates a non-atomic update process: configuration mutation, service activation, and success reporting can disagree. ### Attack Path 1. A user or automation process executes `scripts/apply.sh`. 2. The script backs up and then modifies `~/.openclaw/openclaw.json`. 3. The gateway restart fails because of an invalid configuration, unavailable service, insufficient runtime permissions, or another operational error. 4. `|| true` discards the restart failure. 5. The script prints a completion message despite the failed activation. 6. Bash reaches the stray `PYEOF` command and exits with an error under `set -e`. 7. The modified configuration remains in place because no rollback handler restores the backup. 8. OpenClaw may continue using its old in-memory configuration, ...[truncated 484 chars]- Remediation
View remediation
&1 || true ``` with explicit error handling. 3. Write the patched JSON to a temporary file in the same directory, validate it, preserve ownership and permissions, and atomically rename it over the original. 4. Add a rollback handler that restores `BACKUP_FILE` if configuration validation or gateway restart fails. 5. Verify gateway health after restart rather than relying only on the restart command's exit status. 6. Report success only after validation, restart, and health checks all complete successfully. 7. Return a nonzero status with a clear error message when activation fails. A hardened flow should follow this sequence: ```text Create backup → generate temporary configuration → validate configuration → atomically install configuration → restart gateway → verify health → retain change on success or restore backup on failure ``` ]]>
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The skill description understates operational side effects by presenting the behavior as cost optimization while static analysis indicates it modifies OpenClaw configuration, creates backups, enables diagnostics logging, and restarts the gateway. Hidden or under-disclosed side effects are risky because operators may trigger service interruption, altered logging, or persistent config changes without informed consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description understates operational side effects by presenting the behavior as cost optimization while static analysis indicates it modifies OpenClaw configuration, creates backups, enables diagnostics logging, and restarts the gateway. Hidden or under-disclosed side effects are risky because operators may trigger service interruption, altered logging, or persistent config changes without informed consent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs users to run shell scripts that modify local configuration and restart a gateway, but it declares no explicit tool scope or permissions boundary. This is dangerous because users and host systems cannot easily assess or constrain the file-write capability up front, increasing the chance of unexpected configuration changes or misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation tells users to run a script that automatically updates configuration and restarts the gateway without a prominent warning about service-impacting changes. This is dangerous because it can cause downtime, break existing setups, or apply irreversible changes in environments where restart behavior is sensitive.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script is presented as applying caching optimizations, but it also changes the model alias and restarts the OpenClaw gateway. That mismatch can cause users to approve broader configuration and operational changes than they intended, which is a security-relevant transparency issue because hidden side effects alter trust boundaries and local runtime behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script's comments, usage text, and runtime messages are written in Korean, and there is no indication that users may select another language or that the script is intended only for a Korean-speaking environment. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata promises prompt caching optimizations, but the implementation additionally modifies model alias configuration and triggers a service restart. In a user-trusted automation context, undocumented behavior increases the risk of unauthorized configuration drift, disruption, or redirection of model selection under the guise of optimization.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s natural-language comments and user-facing usage text are written entirely in Korean, and the runtime output later in the script follows the same pattern. For a generally named utility script, this imposes a specific language on users without opt-in or justification, matching the locale/language policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill recommends enabling cache-trace logging to a local JSONL file but does not warn about data retention or possible capture of metadata related to prompt usage. Even local diagnostic logs can create privacy, compliance, or disk-retention issues if operators are unaware of what is recorded and how long it persists.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script directly rewrites the user's primary OpenClaw configuration file after only checking that it exists, without an explicit consent prompt or warning at the point of modification. Although it creates a backup, silent modification of local settings can still lead to unintended persistence, breakage, or difficult-to-detect behavior changes in a trusted developer environment.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all operational guidance only in Korean, with no indication that users can opt into another language or that the locale restriction is intentional and justified.
- Content