Security audit

Zhuaxia

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real OpenClaw backup/import tool, but it handles sensitive local files and imported archives with enough under-scoped safeguards that users should review it carefully before installing.

Install only if you are comfortable reviewing .claw archives and the generated export contents yourself. Do not rely on the stated automatic credential stripping for shared packages, avoid importing from arbitrary URLs or untrusted senders, and use dry-run plus a separate backup before allowing it to write workspace or skill files.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/clawctl.mjs:3238
Finding: Sensitive Files Inside Installed Skills Are Exported Without Filtering
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/clawctl.mjs:3546
Finding: Workspace Files Are Exported Verbatim Without Content Sanitization
Content: View full analysis
0) { console.log(`Removed ${sanitized.removedCredentials.length} sensitive values:`); for (const cred of sanitized.removedCredentials) { console.log(` - ${cred.path} (${cred.provider}:${cred.type})`); } } const workspaceFiles = flags["include-memory"] ? scan.workspaceFiles : scan.workspaceFiles.filter((f2) => f2.relativePath !== "MEMORY.md"); // ... const result = await pack({ ref: parsed, description: flags.description ?? "", sanitizedConfig: sanitized.sanitized, workspaceFiles: workspaceFiles.map((f2) => ({ relativePath: f2.relativePath, content: f2.content, size: f2.size })), removedCredentials: [...sanitized.removedCredentials], plugins: pluginNames, skills: skillInputs, channels, outputDir: stagingDir }); ``` The corresponding documentation states: ```md Sensitive data (API keys, tokens) is automatically stripped. ``` ```md - API keys, tokens, passwords (automatically stripped) ``` ### Technical Analysis The security scan invokes `sanitizeConfig()` only on the parsed `openclaw.json` configuration. Workspace files are selected by filename and forwarded to `pack()` with their original byte content. Although the workspace scanner excludes certain filenames and extensions, it does not inspect the contents of otherwise allowed Markdown, JSON, YAML, text, or source files. Credentials embedded in files such as `IDENTITY.md`, `SOUL.md`, instruction files, notes, or custom configuration documents are the ...[truncated 1345 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/clawctl.mjs:3144
Finding: Configuration Arrays Bypass Recursive Credential Sanitization
Content: View full analysis
matchesJsonPath(pathStr, p2)) ) { const provider = path.length >= 2 ? path[path.length - 2] : "unknown"; const type = key; result[key] = `$CLAW_PLACEHOLDER:${provider}:${type}`; removedCredentials.push({ path: pathStr, provider, type }); } else { const detected = detectSensitiveValues(value); if (detected.length > 0) { const provider = detected[0].name; result[key] = `$CLAW_PLACEHOLDER:${provider}:${key}`; removedCredentials.push({ path: pathStr, provider, type: key }); } else { result[key] = value; } } } else { result[key] = value; } } return result; } const sanitized = walk(config, []); return { sanitized, removedCredentials }; } ``` ### Technical Analysis The recursive branch explicitly excludes arrays by checking `!Array.isArray(value)`. An array consequently falls through to the final `else` branch and is copied into the sanitized result by reference without traversing its elements. Any string secret directly inside an array, or ...[truncated 1106 chars]
Remediation: View remediation
walk(item, [...path, String(index)])); } if (value && typeof value === "object") { return Object.fromEntries( Object.entries(value).map(([key, child]) => [ key, walk(child, [...path, key]) ]) ); } if (typeof value === "string") { return sanitizeString(value, path); } return value; } ``` Additionally: 1. Update path matching so numeric array indices can match wildcard components. 2. Detect sensitive key names such as `token`, `password`, `secret`, `apiKey`, and authorization headers at arbitrary nested depths. 3. Add tests for primitive arrays, arrays of objects, nested arrays, and mixed structures. 4. Validate the final serialized output with a second secret-scanning pass before archive creation. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/clawctl.mjs:3036
Finding: Archive Integrity Verification Does Not Cover Undeclared Installed Files
Content: View full analysis
f2.relativePath.startsWith(`skills/${skillMeta.name}/`) ); for (const f2 of skillFiles) { const relPath = f2.relativePath.slice( `skills/${skillMeta.name}/`.length ); const dest = resolve(targetSkillDir, relPath); await mkdir3(resolve(dest, ".."), { recursive: true }); const content = await readFile4(f2.absolutePath); await writ ...[truncated 2050 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/clawctl.mjs:3024
Finding: Imported Archive Symbolic Links Can Expose Files Outside the Extraction Directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.
md
- **User wants to export + share in one step**: After export, suggest easy transfer methods (AirDrop, scp, cloud drive). - **Multiple .claw files**: If the user says "install all claw packages", iterate through them one by one with preview for each. - **Rollback chain**: Each rollback creates a safety backup, so the user can always undo a rollback. Explain this when asked. - **Disk space**: If the user has many backups, suggest cleaning old ones: `rm -rf ~/.openclaw/.zhuaxia-backups/<old-id>`. ## What Gets Exported

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.
md
- **User wants to export + share in one step**: After export, suggest easy transfer methods (AirDrop, scp, cloud drive). - **Multiple .claw files**: If the user says "install all claw packages", iterate through them one by one with preview for each. - **Rollback chain**: Each rollback creates a safety backup, so the user can always undo a rollback. Explain this when asked. - **Disk space**: If the user has many backups, suggest cleaning old ones: `rm -rf ~/.openclaw/.zhuaxia-backups/<old-id>`. ## What Gets Exported

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.
md
- **User wants to export + share in one step**: After export, suggest easy transfer methods (AirDrop, scp, cloud drive). - **Multiple .claw files**: If the user says "install all claw packages", iterate through them one by one with preview for each. - **Rollback chain**: Each rollback creates a safety backup, so the user can always undo a rollback. Explain this when asked. - **Disk space**: If the user has many backups, suggest cleaning old ones: `rm -rf ~/.openclaw/.zhuaxia-backups/<old-id>`. ## What Gets Exported

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill directs the agent to read files, inspect environment/state, and execute shell commands, but the manifest does not declare any explicit tool scope or allowed-tools boundary. That makes the skill's effective privilege unclear and increases the chance an agent will run sensitive local operations without a clear authorization model.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list includes broad natural-language phrases that could match ordinary requests and invoke a high-impact skill that reads local state, writes config, imports files, and installs bundled skills. Over-broad activation increases the chance of unintended execution of privileged workflows.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
node {baseDir}/scripts/clawctl.mjs backup [--source ] [--label ]

text
Create a snapshot of current workspace + config. Stored in `~/.openclaw/.zhuaxia-backups/<id>/`. ### List Backups

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The workflow says to run when the user says things like broad export/backup phrases, without strong boundaries that this only applies to OpenClaw instance packaging. In context, that ambiguity is risky because the skill performs filesystem discovery and package operations that should require precise user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The import workflow can trigger on generic 'install' or 'load' requests, which may cause the agent to treat unrelated files or tasks as OpenClaw package installs. Because import modifies workspace, config, and skills, accidental invocation has meaningful integrity impact.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.
md
> New items to merge: [list] > Shall I merge the non-sensitive settings? If the user agrees, read both JSON files, merge intelligently (keep current credentials, add new non-sensitive settings), and write back to `openclaw.json`. 3. **Credential checklist** — For each `$CLAW_PLACEHOLDER` in the imported config, tell the user exactly what they need to set:

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill tells the agent to fetch an arbitrary URL with curl and then proceed with import, which extends a local backup/migration workflow into untrusted network retrieval. This can introduce malicious .claw packages, SSRF-style access to internal resources, or accidental retrieval of attacker-controlled content without validation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs network download of external content without warning the user about network access, provenance, or the risk of importing untrusted packages. In a workflow that later installs package contents and bundled skills, lack of a trust warning materially increases the likelihood of compromise.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes portable export/import for backing up, migrating, restoring, and rolling back an OpenClaw setup, but the backup/restore path only copies workspace/ and openclaw.json. It does not preserve or restore other state the exporter scans or excludes elsewhere, such as bundled skill install state unless present in the imported package, so 'rollback' and 'backup my instance' do not actually restore the full setup they imply.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Rollback copies backed-up files over the current workspace and config without deleting files added after the backup or warning about overwrites. This can leave a mixed state where stale or attacker-planted files persist, undermining rollback expectations and potentially preserving malicious content after a supposed recovery.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The load command writes workspace files and bundled skill files from an imported archive directly into the user's target directory without explicit approval. In this skill's context, packages are meant to be shared and imported, so untrusted archives are plausible; that makes silent installation more dangerous because a malicious package can place executable or deceptive content into the user's environment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill is described primarily as exporting and importing OpenClaw instances as portable packages, but runLoad also installs bundled skills into the target skills directory as a separate capability. That behavior is related, but materially broader than just restoring an instance backup because it performs package-managed skill deployment into the local installation.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: SKILL.md:293