Security audit

Approve Pairing

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear purpose, but its credential-editing script has real safeguards missing around sensitive approval files.

Install only if you specifically need a break-glass fallback for approving OpenClaw DM pairings without the CLI. Run it only as the OpenClaw credentials owner, verify channel and account identifiers yourself, avoid elevated privileges, and prefer the official CLI when available. The script should be fixed to validate paths and expiry and to stop printing pending codes before routine use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/approve_pairing.py:34
Finding: Path Traversal Through Unvalidated Channel and Account Identifiers
Content: View full analysis
-allowFrom.json # If accountId is present → --allowFrom.json if account_id: allow_path = creds / f"{channel}-{account_id}-allowFrom.json" else: allow_path = creds / f"{channel}-allowFrom.json" ``` ### Technical Analysis The documentation limits operation to seven supported channels, but the script does not enforce that allowlist. The user-controlled `channel` argument is interpolated directly into filesystem paths. Path separators and parent-directory components such as `../` are not rejected. The `account_id` value obtained from the pairing JSON is also inserted directly into the destination filename. If the pairing file can be influenced, a malicious account identifier containing traversal components can affect the allowlist destination. `pathlib.Path` does not automatically const ...[truncated 1993 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/approve_pairing.py:44
Finding: Expired Pairing Requests Can Still Be Approved
Content: View full analysis
-pairing.json`, whether because cleanup has not run or the gateway is unavailable. 4. The attacker or another caller invokes the script with the expired code. 5. The script finds the request based only on code equality. 6. The sender ID is added to the relevant `allowFrom` file and the expired request is cleared. 7. The attacker obtains DM access despite the pairing code no longer being valid under the documented policy. ### Impact Assessment An expired authorization token can be replayed to approve a sender. This weakens the pairing security boundary and extends the useful lifetime of a leaked or intercepted code beyond the documented one-hour period. The resulting access is scoped to the affected channel and account allowlist, but it can permit an otherwise unauthorized sender to communicate with the OpenClaw d ...[truncated 35 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/approve_pairing.py:47
Finding: Pending Pairing Codes Disclosed After an Invalid Attempt
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs direct reads and writes to credential files and invokes a Python script, but it does not declare any explicit tool scope or permissions. This creates an unsafe mismatch between documented behavior and security boundaries, making it easier for an agent to perform sensitive filesystem actions without clear user-facing authorization controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly bypasses the normal CLI approval flow by directly editing credential files that control pairing and allowlists, yet it provides no warning about integrity, auditability, or accidental authorization risks. Because these files govern who is approved to send DMs, mistaken or unauthorized modification could grant access to untrusted senders or corrupt security state.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.