ClawHub
Back to skill

Security audit

Setup Validator

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended as a setup security checker, but its validation is overstated and it can present unsafe or destructive remediation commands without enough guardrails.

Review this before installing. It is not clearly malicious, but treat it as a basic diagnostic helper rather than a complete security validator. Do not blindly run generated fix commands, especially plugin removal, config reset, global update, or commands containing plugin names from your filesystem. Only enable the cron job if you want recurring local checks and understand what paths and commands it will use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/validate_setup.py:56
Finding

Untrusted Plugin Name Embedded in an Unquoted Remediation Command

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/validate_setup.py:55
Finding

Plugin Safety Check Accepts Malicious Plugins with Minimal Manifests

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/validate_setup.py:107
Finding

Sandbox Validation Accepts Disabled or Unrelated Configuration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/validate_setup.py:35
Finding

Permission Check Fails to Detect World-Readable Configuration

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (18)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill instructs users to run Python scripts and cron jobs that clearly require shell execution and filesystem access, but it does not declare any tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and reviewability, increasing the chance the skill executes with broader capabilities than intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation guidance says to use the skill during initial setup, periodic heartbeats, or whenever security validation is required, which is broad enough to trigger frequent or automatic execution. For a skill that invokes local scripts and shell commands, ambiguous activation expands the attack surface and may cause it to run in contexts where its behavior has not been sufficiently reviewed.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/CHECKS.md (reported line 25)May include surrounding context.

md
Identifies plugins missing the required `openclaw.plugin.json` manifest or with invalid manifest structure.

### Risks
- Malicious plugins can execute arbitrary code.
- Plugins without manifests may not load correctly.
- Vulnerable plugins may expose sensitive data.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Example Fix

Restrict permissions to the minimum required:

bash
chmod 750 ~/.openclaw
chmod 640 ~/.openclaw/config.yaml

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/CHECKS.md (reported line 16)May include surrounding context.

Example Fix

Restrict permissions to the minimum required:

bash
chmod 750 ~/.openclaw
chmod 640 ~/.openclaw/config.yaml

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/EXAMPLE_FIXES.md (reported line 12)May include surrounding context.

Example Fix

Restrict permissions to the minimum required:

bash
chmod 750 ~/.openclaw
chmod 640 ~/.openclaw/config.yaml

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/CHECKS.md (reported line 17)May include surrounding context.

Restrict permissions to the minimum required:

bash
chmod 750 ~/.openclaw
chmod 640 ~/.openclaw/config.yaml

2. Unsafe Plugins

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/EXAMPLE_FIXES.md (reported line 13)May include surrounding context.

Restrict permissions to the minimum required:

bash
chmod 750 ~/.openclaw
chmod 640 ~/.openclaw/config.yaml

2. Unsafe Plugins

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document includes plugin removal and configuration reset commands as direct remediation steps without warning that they may remove installed components or discard local configuration. In a setup/security validation skill, users may copy-paste these commands during troubleshooting, increasing the risk of unintended data loss or service disruption.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/validate_setup.py (reported line 28)May include surrounding context.

python
# Check OpenClaw directory
    if os.path.exists(OPENCLAW_DIR):
        openclaw_mode = os.stat(OPENCLAW_DIR).st_mode
        if openclaw_mode & 0o022:  # World-writable
            issues.append({
                "check": "Excessive Permissions",
                "description": f"OpenClaw directory has excessive permissions: {oct(openclaw_mode)}.",

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/validate_setup.py (reported line 38)May include surrounding context.

python
# Check OpenClaw directory
    if os.path.exists(OPENCLAW_DIR):
        openclaw_mode = os.stat(OPENCLAW_DIR).st_mode
        if openclaw_mode & 0o022:  # World-writable
            issues.append({
                "check": "Excessive Permissions",
                "description": f"OpenClaw directory has excessive permissions: {oct(openclaw_mode)}.",

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/generate_warnings.py (reported line 39)May include surrounding context.

python
issues.append({
                "check": "Excessive Permissions",
                "description": f"OpenClaw directory has excessive permissions: {oct(openclaw_mode)}.",
                "fix": "Run `chmod 750 ~/.openclaw` to restrict permissions."
            })
    
    # Check config file

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/validate_setup.py (reported line 32)May include surrounding context.

python
issues.append({
                "check": "Excessive Permissions",
                "description": f"OpenClaw directory has excessive permissions: {oct(openclaw_mode)}.",
                "fix": "Run `chmod 750 ~/.openclaw` to restrict permissions."
            })
    
    # Check config file

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/validate_setup.py (reported line 42)May include surrounding context.

python
issues.append({
                "check": "Excessive Permissions",
                "description": f"Config file has excessive permissions: {oct(config_mode)}.",
                "fix": "Run `chmod 640 ~/.openclaw/config.yaml` to restrict permissions."
            })
    
    return issues

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/validate_setup.py (reported line 147)May include surrounding context.

python
# OpenClaw is distributed via npm, not pip
    try:
        result = subprocess.run(
            ["npm", "list", "-g", "openclaw", "--json"],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/validate_setup.py (reported line 158)May include surrounding context.

python
if data.get('dependencies', {}).get('openclaw'):
                version = data['dependencies']['openclaw'].get('version', 'unknown')
                # Check against latest
                latest_result = subprocess.run(
                    ["npm", "view", "openclaw", "version"],
                    capture_output=True,
                    text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/validate_setup.py (reported line 187)May include surrounding context.

python
except FileNotFoundError:
        # npm not found - check if openclaw command exists
        try:
            result = subprocess.run(
                ["openclaw", "--version"],
                capture_output=True,
                text=True,

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

Presenting global update commands without cautions can cause system-wide changes, version drift, or compatibility issues with existing plugins and workflows. While not inherently malicious, this is risky in security guidance because users may apply updates blindly and destabilize their environment.

Content

No source excerpt is available for this finding.