Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed security-scanning skill that reads OpenClaw skill folders and can optionally move risky folders into quarantine when the user asks it to.
Install only if you want a local OpenClaw skill scanner. Run it in read-only mode first and review the JSON report before using --quarantine, because the simple regex rules can produce false positives and quarantine will move matching skill folders out of the active skills directory.
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- **Install hooks** (postinstall/preinstall) — supply-chain risk
### Medium severity
- **Prompt injection markers** inside docs ("ignore previous instructions", "system prompt")
- **Obfuscation** (base64 decode/exec patterns)
## False positives
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
talog (v0)
## What we flag (and why)
### High severity
- **Command execution** (Node child_process exec/spawn, Python subprocess, shell scripts)
- **Network egress** (fetch/axios/requests/curl/wget/WebSocket)
- **Sensitive paths** (/.openclaw/, ~/.ssh, /etc, .env)
- **Install hooks** (postinstall/preinstall) — supply-chain risk
### Medium severity
- **Prompt injection markers** inside docs ("ignore previous instructions", "system prompt")
- **Obfuscation** (base64 decode/exec patterns)
## False positives
Many legitimate skills will legitimately:
- fetch docs (network)
- run CLIs
So SecurityClaw should treat these as *risk indicators*, not guilt.
Use allowlists + contextual checks to reduce noise.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Goal
Run dynamic analysis of an untrusted skill without letting it:
- access secrets
- write to real config/memory
- access network
- call privileged tools
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Prompt injection markers
("prompt_injection", "medium", re.compile(r"(ignore\s+previous\s+instructions|system\s+prompt|developer\s+message|exfiltrate|BEGIN\s+SYSTEM\s+PROMPT)", re.I), "Prompt-injection style content found."),
# Path traversal / sensitive file targets
("sensitive_paths", "high", re.compile(r"(~/?\.openclaw/|/etc/|\.ssh/|id_rsa|authorized_keys|keychain|\.env\b)", re.I), "References sensitive paths."),
]
SEVERITY_ORDER = {"info": 0, "low": 1, "medium": 2, "high": 3, "critical": 4}
The skill advertises and instructs use of a Python scanner that reads skill directories, writes reports, moves folders for quarantine, and references optional sandbox execution, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and user review because an installer or agent cannot easily constrain file, shell, or possible network-capable behavior before use.
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
# Very small rule set to start; expand iteratively.
RULES = [
# Supply-chain / install scripts
("install_script", "high", re.compile(r"\b(postinstall|preinstall|install)\b", re.I), "Install scripts can execute arbitrary code."),
# Shell execution
("shell_exec", "high", re.compile(r"\b(child_process\.(exec|execSync|spawn|spawnSync)|os\.system\(|subprocess\.(Popen|run|call)|Runtime\.getRuntime\(\)\.exec)\b", re.I), "Direct command execution found."),
# Network egress
When --quarantine is supplied, the script automatically moves directories with high-severity findings using shutil.move, which changes the filesystem state immediately. Although this is an admin utility rather than covert malware behavior, the action is destructive enough to disrupt workflows or cause accidental removal of active skills if findings are noisy or false positives.
Detected: suspicious.prompt_injection_instructions