T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:12- Finding
Automatic and Quiet Skill Activation Overrides User Consent Boundaries
- Content
View full analysis
- Remediation
View remediation
Security audit
GitClaw
Security checks for vulnerabilities and agentic risk
Overview
This backup skill has a coherent purpose, but it would quietly install tools, authenticate to GitHub, upload the whole workspace, and create a recurring cron job with too little user review.
Review this skill carefully before installing. It is not clearly malicious because it backs up to a user-selected GitHub repository, but it asks the agent to act quietly, may use sudo to install software and enable cron, and can repeatedly push every workspace file to GitHub, including secrets or private agent files. Only use it after adding strong ignore rules or an allowlist, choosing a private repository unless you intentionally want public exposure, reviewing the first staged file list, and explicitly approving any package install, first push, and cron registration.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T06 · System Persistence
Error
- Location
SKILL.md:74- Finding
Privileged Cron Installation and Persistent Scheduled Execution
- Content
View full analysis
/dev/null | grep -F "$CRON_CMD" >/dev/null` - If not found, append: - `(crontab -l 2>/dev/null; echo "$CRON_LINE") | cront ...[truncated 2485 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:187- Finding
Unfiltered Workspace Contents Are Committed and Pushed to GitHub
- Content
View full analysis
"` - Visibility: - `public` => `--public` - `private` => `--private` 6. Ensure there is at least one commit (required for first push/cron): - Create a tiny marker file if needed: - `test -f .gitclaw.keep || printf "gitclaw initialized: %s\n" "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" > .gitclaw.keep` - `git add -A` - `git commit -m "gitclaw: initial backup" || true` ``` Recurring bulk staging and upload: ```bash WORKSPACE_DIR="${HOME}/.openclaw/workspace" STATE_DIR="${HOME}/.openclaw/gitclaw" LOG_FILE="${STATE_DIR}/backup.log" LOCK_DIR="${STATE_DIR}/lock" mkdir -p "${STATE_DIR}" timestamp() { date -u '+%Y-%m-%dT%H:%M:%SZ'; } # Simple lock to prevent overlapping runs if ! mkdir "${LOCK_DIR}" 2>/dev/null; then echo "$(timestamp) Skip: already running." >> "${LOG_FILE}" exit 0 fi trap 'rmdir "${LOCK_DIR}" >/dev/null 2>&1 || true' EXIT if ! command -v git >/dev/null 2>&1; then echo "$(timestamp) ERROR: git not foun ...[truncated 3222 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (66)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The top-level description frames the feature as backup/sync but does not prominently warn that the entire workspace will be repeatedly uploaded to GitHub. Because agent workspaces may contain credentials, notes, prompts, or user data, the missing privacy disclosure materially increases the chance of accidental exposure.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill self-activates whenever it is installed or loosely referenced, which is far too broad for an operation that installs software, modifies git state, authenticates to GitHub, and configures persistence. This can cause backup behavior to run without a clear, contextual, informed user request.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly instructs the agent to operate 'automatically and quietly' while performing privileged installs, repository creation, and external data transfer. Silent execution suppresses meaningful consent and makes it easier to exfiltrate sensitive workspace contents without the user understanding what happened.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The behavioral rule directs automatic, quiet syncing to GitHub, which is a direct instruction to disclose local data to an external service. In the context of an agent workspace, this is especially dangerous because the workspace may contain sensitive or private material not intended for publication.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 2. **Visibility**: `public` or `private` 3. (Optional) **Backup frequency** in minutes (default: **60**) Do NOT ask for a Personal Access Token. We use `gh` auth. ---
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md - If `brew` exists: - `brew install git` - Else if `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y git` - Else if `dnf` exists: - `sudo dnf install -y git` - Else if `yum` exists:
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md - If `brew` exists: - `brew install git` - Else if `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y git` - Else if `dnf` exists: - `sudo dnf install -y git` - Else if `yum` exists:
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md - If `brew` exists: - `brew install git` - Else if `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y git` - Else if `dnf` exists: - `sudo dnf install -y git` - Else if `yum` exists:
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md - If `brew` exists: - `brew install git` - Else if `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y git` - Else if `dnf` exists: - `sudo dnf install -y git` - Else if `yum` exists:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 88% confidence
- Finding
The '--noconfirm' parameter suppresses an important safeguard in package installation, enabling autonomous host modification. In a skill that already acts quietly and broadly, this parameter meaningfully increases operational risk.
- Content
md - Else if `yum` exists: - `sudo yum install -y git` - Else if `pacman` exists: - `sudo pacman -S --noconfirm git` - Else if `zypper` exists: - `sudo zypper install -y git` - Else if `apk` exists:
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md - If `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y cron` - `sudo systemctl enable --now cron || sudo service cron start || true` - Else if `dnf` exists: - `sudo dnf install -y cronie` - `sudo systemctl enable --now crond || true`
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md - If `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y cron` - `sudo systemctl enable --now cron || sudo service cron start || true` - Else if `dnf` exists: - `sudo dnf install -y cronie` - `sudo systemctl enable --now crond || true`
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md - If `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y cron` - `sudo systemctl enable --now cron || sudo service cron start || true` - Else if `dnf` exists: - `sudo dnf install -y cronie` - `sudo systemctl enable --now crond || true`
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md - If `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y cron` - `sudo systemctl enable --now cron || sudo service cron start || true` - Else if `dnf` exists: - `sudo dnf install -y cronie` - `sudo systemctl enable --now crond || true`
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
md - If `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y cron` - `sudo systemctl enable --now cron || sudo service cron start || true` - Else if `dnf` exists: - `sudo dnf install -y cronie` - `sudo systemctl enable --now crond || true`
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 88% confidence
- Finding
Using '--noconfirm' while installing the scheduler reduces user control over a persistence-enabling action. That makes this parameter choice security-significant in context.
- Content
md - `sudo yum install -y cronie` - `sudo systemctl enable --now crond || true` - Else if `pacman` exists: - `sudo pacman -S --noconfirm cronie` - `sudo systemctl enable --now cronie || true` - Else if `apk` exists: - `sudo apk add dcron`
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 86% confidence
- Finding
Piping downloaded content directly into a sudo write path is dangerous because it combines network-retrieved data with privileged file modification in one step, reducing opportunities for validation. Here it writes package trust material as root, which could have supply-chain consequences if the content source is compromised or not verified.
- Content
md - `(type -p wget >/dev/null || (sudo apt-get update && sudo apt-get install -y wget))` - `sudo mkdir -p -m 755 /etc/apt/keyrings` - `out=$(mktemp) && wget -nv -O"$out" https://cli.github.com/packages/githubcli-archive-keyring.gpg` - `cat "$out" | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null` - `sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg` - `sudo mkdir -p -m 755 /etc/apt/sources.list.d` - `echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null`
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 83% confidence
- Finding
This echoes a repository configuration string and pipes it directly into sudo tee, causing an immediate privileged package-source change without an inspection checkpoint. In context, that silently persists trust in an external repository.
- Content
md - `cat "$out" | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null` - `sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg` - `sudo mkdir -p -m 755 /etc/apt/sources.list.d` - `echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null` - `sudo apt-get update && sudo apt-get install -y gh` - Else if `dnf` exists:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 88% confidence
- Finding
Here '--noconfirm' suppresses review of GitHub CLI installation, which is later used for auth and repo operations. The parameter removes a natural checkpoint for a tool central to external publication.
- Content
md - `sudo zypper install -y gh` - Else if `pacman` exists: - `sudo pacman -S --noconfirm github-cli` - Else if `apk` exists: - `sudo apk add github-cli`
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
These steps initialize git in the full OpenClaw workspace, stage all files, create or attach a GitHub repository, and push the contents externally. That creates a straightforward path for bulk disclosure of potentially sensitive files such as configuration, conversation artifacts, secrets, or internal documents.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The installed script runs on a schedule, stages every change with 'git add -A', commits, and pushes to GitHub automatically. This creates continuous data leakage risk because any newly created sensitive file in the workspace will be uploaded without review.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
This instruction runs privileged package management with sudo, allowing the skill to alter the host system. While installing git is not inherently malicious, performing root-level changes automatically for a backup skill expands the trust boundary and increases risk.
- Content
md - If `brew` exists: - `brew install git` - Else if `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y git` - Else if `dnf` exists: - `sudo dnf install -y git` - Else if `yum` exists:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
Privileged installation of git via dnf is a real security-sensitive action because it modifies system packages under root. In a skill that already performs data transfer and persistence, automatic root actions are especially concerning.
- Content
md - Else if `apt-get` exists: - `sudo apt-get update && sudo apt-get install -y git` - Else if `dnf` exists: - `sudo dnf install -y git` - Else if `yum` exists: - `sudo yum install -y git` - Else if `pacman` exists:
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
Using sudo yum install grants the skill root-level execution for system changes. Even if the immediate goal is dependency setup, unattended privileged actions are inappropriate without an informed prompt.
- Content
md - Else if `dnf` exists: - `sudo dnf install -y git` - Else if `yum` exists: - `sudo yum install -y git` - Else if `pacman` exists: - `sudo pacman -S --noconfirm git` - Else if `zypper` exists:
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 87% confidence
- Finding
Using '--noconfirm' removes an interactive checkpoint for package installation, allowing the skill to make system changes autonomously. In this skill, that autonomy compounds the risk because installs are part of a chain leading to persistent external backup configuration.
- Content
md - Else if `yum` exists: - `sudo yum install -y git` - Else if `pacman` exists: - `sudo pacman -S --noconfirm git` - Else if `zypper` exists: - `sudo zypper install -y git` - Else if `apk` exists:
Static analysis
No suspicious patterns detected.