SecurityClaw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:52 AM UTC
• Version: 1.0.0

Overview

This is a disclosed security-scanning skill that reads OpenClaw skill folders and can optionally move risky folders into quarantine when the user asks it to.

Install only if you want a local OpenClaw skill scanner. Run it in read-only mode first and review the JSON report before using --quarantine, because the simple regex rules can produce false positives and quarantine will move matching skill folders out of the active skills directory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Instruction Override

High

• Category: Prompt Injection

Content

- **Install hooks** (postinstall/preinstall) — supply-chain risk

### Medium severity
- **Prompt injection markers** inside docs ("ignore previous instructions", "system prompt")
- **Obfuscation** (base64 decode/exec patterns)

## False positives

• Confidence: 80% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

talog (v0)

## What we flag (and why)

### High severity
- **Command execution** (Node child_process exec/spawn, Python subprocess, shell scripts)
- **Network egress** (fetch/axios/requests/curl/wget/WebSocket)
- **Sensitive paths** (/.openclaw/, ~/.ssh, /etc, .env)
- **Install hooks** (postinstall/preinstall) — supply-chain risk

### Medium severity
- **Prompt injection markers** inside docs ("ignore previous instructions", "system prompt")
- **Obfuscation** (base64 decode/exec patterns)

## False positives
Many legitimate skills will legitimately:
- fetch docs (network)
- run CLIs

So SecurityClaw should treat these as *risk indicators*, not guilt.
Use allowlists + contextual checks to reduce noise.

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Credential Access

High

• Category: Privilege Escalation

Content

## Goal
Run dynamic analysis of an untrusted skill without letting it:
- access secrets
- write to real config/memory
- access network
- call privileged tools

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Prompt injection markers
    ("prompt_injection", "medium", re.compile(r"(ignore\s+previous\s+instructions|system\s+prompt|developer\s+message|exfiltrate|BEGIN\s+SYSTEM\s+PROMPT)", re.I), "Prompt-injection style content found."),
    # Path traversal / sensitive file targets
    ("sensitive_paths", "high", re.compile(r"(~/?\.openclaw/|/etc/|\.ssh/|id_rsa|authorized_keys|keychain|\.env\b)", re.I), "References sensitive paths."),
]

SEVERITY_ORDER = {"info": 0, "low": 1, "medium": 2, "high": 3, "critical": 4}

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and instructs use of a Python scanner that reads skill directories, writes reports, moves folders for quarantine, and references optional sandbox execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and user review because an installer or agent cannot easily constrain file, shell, or possible network-capable behavior before use.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

# Very small rule set to start; expand iteratively.
RULES = [
    # Supply-chain / install scripts
    ("install_script", "high", re.compile(r"\b(postinstall|preinstall|install)\b", re.I), "Install scripts can execute arbitrary code."),
    # Shell execution
    ("shell_exec", "high", re.compile(r"\b(child_process\.(exec|execSync|spawn|spawnSync)|os\.system\(|subprocess\.(Popen|run|call)|Runtime\.getRuntime\(\)\.exec)\b", re.I), "Direct command execution found."),
    # Network egress

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: When --quarantine is supplied, the script automatically moves directories with high-severity findings using shutil.move, which changes the filesystem state immediately. Although this is an admin utility rather than covert malware behavior, the action is destructive enough to disrupt workflows or cause accidental removal of active skills if findings are noisy or false positives.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/rules.md:12