ClawHub
Back to skill

Security audit

System Healthcheck

Security checks for vulnerabilities and agentic risk

Overview

This health-check skill is mostly coherent, but it asks for recurring host execution while some documented controls are ineffective and several checks are broader than users may expect.

Install only if you are comfortable with recurring cron jobs that inspect local OpenClaw files, process/service state, logs, package-update status, and broad temporary/cache directories. Review the scripts before enabling cron, remove cron entries to truly disable scheduled checks, and avoid running the scripts with elevated privileges.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Note
Location
scripts/l1_fast_check.py:80
Finding

Unnecessary Reading of Sensitive OpenClaw Agent Files

Content
View full analysis
tuple: """检查文件是否存在 Returns: (exists: bool, size_kb: int, readable: bool) """ if not file_path.exists(): return False, 0, False try: size = file_path.stat().st_size size_kb = size // 1024 # 检查是否可读 with open(file_path, "r", encoding="utf-8") as f: f.read(1024) # 只读 1KB 测试 return True, size_kb, True ``` The files passed to this function include `SOUL.md`, `IDENTITY.md`, `AGENTS.md`, `TOOLS.md`, and `MEMORY.md`, as defined at `scripts/l1_fast_check.py:34-40`. ### Technical Analysis The L1 feature is presented as an existence, size, and readability check. However, the implementation opens each configured file and reads up to 1 KB of its contents. Reading content is unnecessary for establishing that a file exists or determining its size. These OpenClaw files may contain Agent identity information, behavioral instructions, tool definitions, or persistent memory. Consequently, the implementation crosses a least-privilege boundary even though the current code does not retain, display, or transmit the data. The immediate implementation does not contain an exfiltration channel. Nevertheless, unnecessarily loading sensitive content into the process increases exposure if the script, an imported local module, or a future version is compromised. ### Attack Path 1. The user or an OpenClaw initialization hook invokes `scripts/l1_fast_check.py`. 2. The script resolves the default workspace under `~/.openclaw/workspace`. 3. It iterates over sensitive Agent files, including `MEMORY.md`, `SOUL.md`, and `AGENTS.md`. 4. `check_file_exists()` opens every existing file. 5. Th ...[truncated 638 chars]
Remediation
View remediation
tuple: if not file_path.is_file(): return False, 0, False try: size_kb = file_path.stat().st_size // 1024 readable = os.access(file_path, os.R_OK) return True, size_kb, readable except OSError: return True, 0, False ``` - Make checks of `MEMORY.md`, `SOUL.md`, and other sensitive Agent files explicitly opt-in. - Restrict configurable filenames to the intended workspace and reject absolute paths or traversal components. - Add a regression test confirming that L1 performs no content reads. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/l3_daily_audit.py:204
Finding

Overbroad Recursive Enumeration of Shared Temporary Directories

Content
View full analysis
dict: """检查磁盘清理需求""" try: # 检查常见临时目录 temp_dirs = ["/tmp", "/var/tmp", Path.home() / ".cache"] total_temp_size = 0 for temp_dir in temp_dirs: temp_path = Path(temp_dir) if temp_path.exists(): try: for item in temp_path.rglob("*"): if item.is_file(): total_temp_size += item.stat().st_size except: pass # 权限问题跳过 ``` ### Technical Analysis The L3 audit recursively enumerates every accessible file below `/tmp`, `/var/tmp`, and the invoking user's entire cache directory. The declared purpose only requires determining whether OpenClaw or Skill-related temporary data needs cleanup. System temporary directories are shared by unrelated applications and, depending on host permissions, other users. Traversing them exceeds the minimum filesystem scope needed for the health-check feature. Although file contents are not read, names, directory structure, types, and sizes are inspected. The traversal has no maximum depth, file-count limit, time budget, mount-boundary restriction, or protection against very large directory structures. An unprivileged local user or application able to populate a traversed directory could create a deeply nested or extremely large tree, causing excessive I/O and making scheduled L3 runs consume significant CPU and execution time. Broad `except` blocks suppress traversal failures, making incomplete or abnormal scans difficult to diagnose. ### Attack Path 1. The user installs the documented daily cron entry or manually invokes `scripts/l3_daily_audit.py`. 2. A local user or application cre ...[truncated 1084 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/l2_hourly_check.py:392
Finding

Documented Check-Disable Controls Are Not Enforced

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (56)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · INSTALL.md (reported line 129)May include surrounding context.

"scripts" / "l1_fast_check.py")], capture_output=True, text=True, timeout=1 )

if result.returncode != 0: print(f"⚠️ Warning: {result.stdout}")

text

### 5.2 心跳机制

心跳检查已设计为智能输出：
- 工作时间（9-18 点）：有问题时输出，正常时输出 `HEARTBEAT_OK`
- 非工作时间：静默

---

## 6. 常见问题

### Q: 提示找不到 Python
A: 修改 crontab 中的 `PYTHON` 路径：
```bash
which python3  # 查看 Python 路径

Q: Cron 服务未运行

A: 启动 Cron 服务：

bash
# Linux
sudo systemctl start cron
sudo systemctl enable cron

# macOS
sudo launchctl load -w /System/Library/LaunchDaemons/com.vix.cron.plist

Q: 输出乱码

A: 确保终端支持 UTF-8：

bash
export LANG=en_US.UTF-8  # 或 zh_CN.UTF-8

Q: 如何禁用某项检查？

A: 编辑 config/default_config.yaml，设置 enabled: false

7. 卸载

bash
# 删除技能目录
rm -rf ~/.openclaw/skills/system-healthcheck

# 移

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 160)May include surrounding context.

bash
# 删除技能目录
rm -rf ~/.openclaw/skills/system-healthcheck

# 移除 crontab 配置
crontab -e

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 160)May include surrounding context.

bash
# 删除技能目录
rm -rf ~/.openclaw/skills/system-healthcheck

# 移除 crontab 配置
crontab -e

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 167)May include surrounding context.

删除相关行

清理日志（可选）

rm ~/.openclaw/workspace/logs/healthcheck*.log

text

---

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · DEVELOPMENT_SUMMARY.md (reported line 173)May include surrounding context.

方式 2: 手动安装

bash
# 已安装在本地
cd ~/.openclaw/skills/system-healthcheck

📋 使用指南

快速测试

bash
cd ~/.openclaw/skills/system-healthcheck

# L1 检查
python scripts/l1_fast_check.py

# L2 检查
python scripts/l2_hourly_check.py

# L3 审计
python scripts/l3_daily_audit.py

# 心跳检查
python scripts/heartbeat.py --force

配置 Crontab

bash
# 编辑 crontab
crontab -e

# 添加以下配置（修改路径）
PYTHON=/usr/bin/python3
HEALTHCHECK_DIR=$HOME/.openclaw/skills/system-healthcheck
WORKSPACE=$HOME/.openclaw/workspace

# L2 小时级检查
0 * * * * cd $HEALTHCHECK_DIR && $PYTHON scripts/l2_hourly_check.py >> $WORKSPACE/logs/healthcheck.log 2>&1

# 心跳检查（每 30 分钟）
*/30 * * * * cd $HEALTHCHECK_DIR && $PYTHON scripts/heartbeat.py >> $WORKSPACE/logs/heartbeat.log 2>&1

# L3 日级审计（每日 08:00）
0 8 * * * cd $HEALTHCHECK_DIR && $PYTHON scripts/l3_daily_audit.py >> $WORKSPACE/logs/healthc

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · PUBLISHED.md (reported line 82)May include surrounding context.

方式 2: 手动安装

bash
# 已安装在本地
cd ~/.openclaw/skills/system-healthcheck

📋 使用指南

快速测试

bash
cd ~/.openclaw/skills/system-healthcheck

# L1 检查
python scripts/l1_fast_check.py

# L2 检查
python scripts/l2_hourly_check.py

# L3 审计
python scripts/l3_daily_audit.py

# 心跳检查
python scripts/heartbeat.py --force

配置 Crontab

bash
# 编辑 crontab
crontab -e

# 添加以下配置（修改路径）
PYTHON=/usr/bin/python3
HEALTHCHECK_DIR=$HOME/.openclaw/skills/system-healthcheck
WORKSPACE=$HOME/.openclaw/workspace

# L2 小时级检查
0 * * * * cd $HEALTHCHECK_DIR && $PYTHON scripts/l2_hourly_check.py >> $WORKSPACE/logs/healthcheck.log 2>&1

# 心跳检查（每 30 分钟）
*/30 * * * * cd $HEALTHCHECK_DIR && $PYTHON scripts/heartbeat.py >> $WORKSPACE/logs/heartbeat.log 2>&1

# L3 日级审计（每日 08:00）
0 8 * * * cd $HEALTHCHECK_DIR && $PYTHON scripts/l3_daily_audit.py >> $WORKSPACE/logs/healthc

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This code chunk is solely an i18n module, which aligns only with the declared mention of i18n support. It does not implement the declared primary purpose of three-tier system health monitoring or any heartbeat behavior. It also accesses environment variables, system locale APIs, and filesystem locale files, which are not part of the described monitoring-only functionality. Additionally, it attempts to import PyYAML, so the implementation is not strictly zero external dependencies, even though it has a fallback parser. Overall, the actual behavior is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code behavior only partially matches the description. It does support i18n and console/JSON output, but the primary implemented behavior is a local filesystem integrity/readability check for a handful of critical files. The declared description promises a broader three-tier health monitoring system with a heartbeat mechanism, which is not present in this code chunk. Additionally, the 'zero external dependencies' claim is weakened because the code attempts to import the external yaml module for config loading, even if it can fall back without it. Therefore this chunk does not accurately represent the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code is broadly aligned with system health monitoring and does include i18n support, so the general domain matches. However, the declared description claims a three-tier monitoring system with a heartbeat mechanism, while this specific code chunk only performs L2 hourly checks and contains no heartbeat logic. It also claims zero external dependencies, but load_config() conditionally imports yaml, which is an external dependency if configuration loading is used. Finally, the description says console output only, but the script supports --json output in addition to human-readable console formatting. These are material description/behavior mismatches, even though the main purpose remains health checking.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code generally aligns with a system health monitoring/audit purpose, uses no third-party dependencies, and references i18n support. However, the declared description specifically mentions a heartbeat mechanism, which is not present in this code chunk. It also says console output only, but the script supports structured JSON output and a detailed report mode, which is materially broader than plain console-only status display. Additionally, the script performs package update checks using system package managers; while adjacent to health monitoring, this is a distinct audit capability not stated in the description. Therefore the description does not fully and accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/l3_daily_audit.py (reported line 383)May include surrounding context.

python
for check in results["checks"]:
            if check.get("status") in ["warning", "error", "critical"]:
                if check["check"] == "updates":
                    lines.append("- Run system updates: `sudo apt update && sudo apt upgrade`")
                elif check["check"] == "old_logs":
                    lines.append("- Clean old log files in workspace/logs/")
                elif check["check"] == "disk_cleanup":

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

For all file types, language or locale policy violations should be flagged when a skill forces or automatically applies a locale without user opt-in. The lines describing automatic system-language detection and support for en/zh-CN do not mention any user selection, override, or consent mechanism.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 71)May include surrounding context.

bash
# 查看已配置的任务
crontab -l

# 查看系统 Cron 服务状态
systemctl status cron  # Linux

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 138)May include surrounding context.

A: 启动 Cron 服务：

bash
# Linux
sudo systemctl start cron
sudo systemctl enable cron

# macOS

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 139)May include surrounding context.

A: 启动 Cron 服务：

bash
# Linux
sudo systemctl start cron
sudo systemctl enable cron

# macOS

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 142)May include surrounding context.

A: 启动 Cron 服务：

bash
# Linux
sudo systemctl start cron
sudo systemctl enable cron

# macOS

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 139)May include surrounding context.

bash
# Linux
sudo systemctl start cron
sudo systemctl enable cron

# macOS
sudo launchctl load -w /System/Library/LaunchDaemons/com.vix.cron.plist

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 142)May include surrounding context.

sudo systemctl enable cron

macOS

sudo launchctl load -w /System/Library/LaunchDaemons/com.vix.cron.plist

text

### Q: 输出乱码

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 142)May include surrounding context.

sudo systemctl enable cron

macOS

sudo launchctl load -w /System/Library/LaunchDaemons/com.vix.cron.plist

text

### Q: 输出乱码

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The markdown provides rm -rf ~/.openclaw/skills/system-healthcheck and log deletion commands as uninstall steps, but it does not explicitly warn users that these commands permanently delete the installed skill directory and logs. For markdown files, destructive actions that can affect user data or system state should be accompanied by a clear warning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file is natural-language content, and it presents all operational guidance and status information in Chinese while also linking to separate English documentation elsewhere. Because the file itself does not offer the user a language choice or explain that it is intentionally region-specific, it can violate the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file is written entirely in Chinese, including operational release instructions, with no indication in the file itself that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill documentation advertises commands that read files, inspect environment-dependent state, and execute local shell/Python without declaring any explicit tool scope or permissions model. In agent environments, missing scope declarations can cause over-broad execution authority and make it harder for operators to understand or constrain what the skill is allowed to access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The instructions explicitly tell the user to install recurring cron entries, which creates persistence on the host. Even though this is framed as normal monitoring setup, persistence mechanisms are security-sensitive because they can continuously execute code, survive beyond the initial session, and expand the blast radius if the skill or referenced scripts are later modified or compromised.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

bash
cat templates/crontab_example.txt
# Copy and edit crontab
crontab -e

4. Heartbeat Check

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file contains natural-language instructions and descriptions entirely in Chinese, including the primary usage documentation, while also presenting a bilingual title. Under the policy rule, forcing a specific language without opt-in or a documented region-specific justification is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
INSTALL.md:160