Security audit

OpenClaw Agent Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to create OpenClaw agents, but its creation script can delete/replace paths and copy broad workspace contents without enough validation or warning.

Review before installing. Use only trusted agent IDs and source workspaces, back up OpenClaw state first, and patch the script to validate IDs, enforce that destinations stay under OPENCLAW_HOME/workspaces, avoid default full-workspace cloning, skip sensitive files and symlinks, and require explicit confirmation before overwriting any existing workspace.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/create-agent.sh:13
Finding: Unvalidated Agent Identifier Enables Destructive Path Traversal
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi ``` 2. Resolve the workspace root and destination to canonical paths, then verify that the destination remains a strict child of the intended root: ```python workspace_root = (Path(os.environ["OPENCLAW_HOME"]).expanduser() / "workspaces").resolve() dst = (workspace_root / sys.argv[2]).resolve() if dst.parent != workspace_root: raise SystemExit("destination escapes the workspace root") ``` 3. Reject identifiers containing path separators, `.` components, or `..` components even if other validation is added. 4. Avoid unconditional recursive deletion. Refuse to overwrite an existing workspace by default, or require a separate explicit replacement flag and confirmation. 5. Perform all path validation before modifying any files and before calling `shutil.rmtree`. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/create-agent.sh:18
Finding: Unrestricted Workspace Cloning Exposes Sensitive Data to Durable Agents
Content: View full analysis
bool: return name.startswith("._") or name.startswith("backup-") or name in skip_names for current_root, dirnames, filenames in os.walk(src, topdown=True, onerror=lambda e: None): current = Path(current_root) rel = current.relative_to(src) target_dir = dst / rel target_dir.mkdir(parents=True, exist_ok=True) dirnames[:] = [name for name in dirnames if not ignored(name)] for filename in filenames: if ignored(filename): continue source_file = current / filename target_file = target_dir / filename try: shutil.copy2(source_file, target_file) except (PermissionError, OSError): continue ``` ### Technical Analysis The script creates a durable agent by recursively copying almost the entire source workspace. Its denylist excludes only `.git`, `.DS_Store`, `__pycache__`, AppleDouble files, and names beginning with `backup-`. This approach does not exclude common sensitive material such as environment files, API keys, credentials, private keys, runtime state, memory files, session artifacts, logs, configuration files, or user documents. It therefore grants the new durable agent access to data that is not necessarily required for agent creation or identity initialization. Additionally, `shutil.copy2` follows symbolic links by default. A symbolic link located inside the source workspace may cause content from its target to be copied into the new workspace, subject to the invoking user's read permissions. The new agent workspace is then ...[truncated 1409 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description emphasizes creating and repairing durable OpenClaw agents, bindings, and runtime state, and preferring verified add flows that actually change live state. The supplied code does not perform any add, repair, update, or other mutating operation. It only queries and prints existing state: agents, bindings, cron jobs, and sessions. That makes the primary purpose materially different: inspection/verification rather than creation/repair. The inclusion of cron inspection is also outside the stated scope, though the larger mismatch is that the code is entirely read-only while the description promises state-changing orchestration behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs the agent to run local scripts and OpenClaw CLI commands that can inspect and modify live runtime state, but it does not declare any explicit tool scope or permission boundaries. In a skill system, missing tool constraints increases the chance that the skill can access file read/write or state-changing capabilities beyond what reviewers and callers expect, enabling unintended execution paths or privilege creep.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script unconditionally deletes the target workspace with shutil.rmtree(dst) whenever it already exists, without prompting, backup, or validating that the destination is within an expected safe directory. Because AGENT_ID influences the destination path, a mistaken or malformed invocation can destroy an existing agent workspace and all contained state. In this skill context, the script is explicitly designed to make durable live-state changes, which makes silent destructive behavior more dangerous rather than less.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The script invokes openclaw agents add and openclaw agents set-identity, which change local agent state and configuration, but the user is not warned beforehand that the script will register or update an agent. The only nearby message appears after existence has already been checked and does not broadly disclose these modifications.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.