Security audit

Openclaw Issue

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear OpenClaw issue-filing purpose, but its command examples can execute unsafe local commands if issue text is inserted into them naively.

Use this skill only if the agent generates issue URLs through safe argument passing or structured encoding, not by pasting user text into the shown shell snippets. Prefer the prefilled URL flow with a manual review before submission, and avoid the GitHub CLI path unless the command is built without shell interpolation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:81
Finding: Command Injection in Inline Python URL Generation
Content: View full analysis
' body = '''''' encoded_title = urllib.parse.quote(title) encoded_body = urllib.parse.quote(body) url = f'https://github.com/openclaw/clawhub/issues/new?title={encoded_title}&body={encoded_body}' print(url) " ``` ### Technical Analysis The instructions place issue title and body content directly inside an inline Python program that is itself enclosed in a double-quoted shell argument. No safe argument passing, escaping, or serialization boundary is used. This creates two injection surfaces: 1. Shell metacharacters and command substitutions embedded in substituted issue content may be interpreted by the shell before `python3` starts. 2. Quotes or Python syntax in the title or body may terminate the intended Python string and inject additional Python statements. URL encoding occurs only after the data has already been parsed by the shell and Python interpreter, so it does not mitigate either injection risk. ### Attack Path 1. An attacker supplies a crafted issue title or body containing shell substitution syntax or content that breaks out of the Python string literal. 2. The agent replaces `` or `` with that untrusted content. 3. The agent executes the documented `python3 -c` command. 4. The shell evaluates applicable substitutions, or Python interprets injected statements. 5. Arbitrary commands or Python operations run with the privileges of the user executing the skill. ### Impact Assessment Successful exploitation can execute local commands or Python code under the invoking user's account. The resulting access may include reading files available to that user, modifying project or user files, accessing environment variables and locally available credentials, an ...[truncated 181 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:98
Finding: Shell Command Injection in GitHub CLI Issue Creation
Content: View full analysis
" \ --body "" \ --label "" ``` ### Technical Analysis The documented command places title, body, and label placeholders directly inside a shell command. Double quotes prevent ordinary word splitting but do not prevent command substitution. Crafted values can also contain quote characters that terminate the intended argument and introduce additional shell syntax. Consequently, replacing these placeholders through string construction does not preserve a safe separation between data and executable shell syntax. The fixed repository destination does not mitigate local command injection. ### Attack Path 1. An attacker supplies a crafted issue title, body, or label containing shell-evaluated syntax. 2. The agent substitutes the supplied value into the command template. 3. The generated command is executed through a shell. 4. The shell evaluates the injected syntax before or alongside the `gh` invocation. 5. Attacker-selected commands execute with the invoking user's permissions. ### Impact Assessment Exploitation can compromise the local account context used to run the skill. An attacker may read or modify accessible files, obtain environment variables or locally stored authentication material, alter repositories, or make network requests. If the GitHub CLI is authenticated, misuse of the execution context may also affect GitHub resources available to that authenticated account. No independent privilege-escalation mechanism is present; the scope is limited to the existing permissions of the invoking process and its credentials. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest’s user-facing summary is entirely in Chinese, which can impose a language preference without any stated opt-in or indication that the skill is intended only for Chinese-speaking users. Under the policy, locale or language constraints should either be optional for the user or clearly documented and justified.
Content: No source excerpt is available for this finding.