OpenClaw Guide

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:38 AM UTC
• Version: 1.0.0

Overview

This skill is a documentation lookup helper for OpenClaw, and I found no hidden persistence, destructive behavior, or data exfiltration in the artifacts.

Before installing, expect this skill to use web access for docs.openclaw.ai and github.com/openclaw/openclaw. If you run the bundled GitHub helper, use a low-privilege or unauthenticated gh setup when possible because it can inherit local GitHub CLI authentication.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs use of network access (web_search/web_fetch) and shell-style commands, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where the runtime may grant broader capabilities than intended, increasing the risk of unintended outbound access or tool misuse if the skill is invoked in a permissive environment.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Important Notes

- **Always verify**: Never assume knowledge about OpenClaw features without checking official sources
- **Stay current**: OpenClaw evolves rapidly; always check for the latest documentation
- **Be precise**: Provide exact commands, file paths, and configuration options when available
- **Cite sources**: Always include links to official documentation or source code

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill is framed as a documentation lookup helper, but it is implemented by invoking the local GitHub CLI, which inherits the host's installed tooling, authentication context, and network reach. In an agent setting, this broadens capability beyond simple retrieval and can expose repository metadata, private access reachable via ambient gh auth, or unintended external interactions if an attacker can influence tool use.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

raise ValueError(f"Unknown search type: {search_type}")
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, check=True)
        return {"success": True, "output": result.stdout, "error": None}
    except subprocess.CalledProcessError as e:
        return {"success": False, "output": None, "error": e.stderr}

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

raise ValueError(f"Unknown search type: {search_type}")
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, check=True)
        return {"success": True, "output": result.stdout, "error": None}
    except subprocess.CalledProcessError as e:
        return {"success": False, "output": None, "error": e.stderr}

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Scope Creep

Low

• Category: Excessive Agency

Content

### 3. Information Synthesis and Presentation
- Analyze gathered information from official sources
- Present clear, concise, and actionable guidance
- Avoid speculation or assumptions beyond documented facts
- Acknowledge when information is not available in official sources

### 4. Response Quality Standards

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

### 3. Information Synthesis and Presentation
- Analyze gathered information from official sources
- Present clear, concise, and actionable guidance
- Avoid speculation or assumptions beyond documented facts
- Acknowledge when information is not available in official sources

### 4. Response Quality Standards

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.