Multi-Agent Tenant Upgrade

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:52 PM UTC
• Version: 1.5.2

Overview

The skill mostly matches its stated OpenClaw UI purpose, but it warrants Review because it persistently patches sensitive auth/session/gateway code and exposes raw auth profile identifiers to the UI while scope documentation is inconsistent.

Install only if you are comfortable patching and rebuilding OpenClaw itself. Review the auth badge changes before applying, ideally changing them to return only oauth/api/fallback rather than raw profile IDs. Treat the session history feature as sensitive because it exposes stored conversations to the Control UI. Avoid the temporary Python config repair command unless you first make a backup and replace it with a JSONC-aware, atomic edit process.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/v1.5.0/patch-auth-badge.txt:36

Finding

Authentication Profile Identifiers Are Exposed to UI Clients

Content

View full analysis

{ try { const store = loadAuthProfileStore(); const lastGood = store?.lastGood ?? {}; const profiles = store?.profiles ?? {}; const anthropicProfileId = lastGood["anthropic"] ?? null; const cred = anthropicProfileId ? profiles[anthropicProfileId] : null; let mode: "oauth" | "api" | "fallback" | "unknown" = "unknown"; if (cred?.type === "token") { mode = "oauth"; } else if (cred?.type === "api_key" && anthropicProfileId?.startsWith("anthropic:")) { mode = "api"; } else if (anthropicProfileId && !anthropicProfileId.startsWith("anthropic:")) { mode = "fallback"; } respond(true, { profileId: anthropicProfileId, mode }, undefined); } catch (err) { respond(false, undefined, String(err)); } }, ``` ```ts function renderAuthBadge(profileId: string | undefined, role: string) { if (role !== "assistant" || !profileId) { return nothing; } let label: string; let cls: string; // Handle fallback mode hint (e.g. "__mode:oauth") if (profileId.startsWith("__mode:")) { const mode = profileId.slice(7); if (mode === "oauth") { label = "OAuth"; cls = "auth-badge auth-badge--oauth"; } else if (mode === "api") { label = "API"; cls = "auth-badge auth-badge--api"; } else { label = "Fallback"; cls = "auth-badge auth-badge--fallback"; } } else if (profileId.includes(":manual") || ...[truncated 2438 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:568

Finding

Documented Configuration Repair Command Can Corrupt the Live Configuration

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

| `server-agents.txt` | `src/gateway/server-methods/agents.ts` | Adds `agents.wizard` RPC; fixes `agents.update` to write `- Emoji:` (not `- Avatar:`) so emoji

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The skill introduces direct outbound HTTP requests to third-party model APIs using locally resolved credentials, including API keys from config, auth profiles, or environment variables. Even if intended functionality is legitimate, any feature that transmits user-supplied content off-system and accesses secrets increases the attack surface and creates risk of unintended data disclosure or credential misuse if the implementation is flawed or expanded later.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

### External API Calls

`agents.wizard` makes a single HTTP POST to:
- `https://api.anthropic.com/v1/messages` (Anthropic models)
- `https://api.openai.com/v1/chat/completions` (OpenAI-compatible models)

No other outbound calls. The call carries your user-supplied description and nothing else from your system.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The skill also supports direct transmission to OpenAI-compatible endpoints, again relying on sensitive credentials and external network egress. In the context of an installable agent skill that patches backend code, this is security-relevant because it extends trusted code paths to contact third-party services and process user input outside the local boundary.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

`agents.wizard` makes a single HTTP POST to:
- `https://api.anthropic.com/v1/messages` (Anthropic models)
- `https://api.openai.com/v1/chat/completions` (OpenAI-compatible models)

No other outbound calls. The call carries your user-supplied description and nothing else from your system.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The patch-scope section claims the skill modifies only agent-related files, but the same document later describes changes to sessions, auth handling, model catalog behavior, runner logic, and gateway internals. This kind of scope misrepresentation can cause reviewers to underestimate the breadth of privileged changes and approve modifications that affect sensitive authentication and execution paths without appropriate scrutiny.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code performs a destructive operation by calling agents.delete, but the handler itself contains no user-facing disclosure, prompt text, log message, or comment warning about the deletion's impact. Under the code-file criteria, destructive or irreversible actions should have some visible disclosure unless clearly covered elsewhere, and that coverage is not present in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code adds a new "sessions.history" handler that reads stored session transcript files and returns message text, timestamps, and roles. The operation accesses potentially sensitive user conversation history, but there is no visible confirmation, logging, comment-level warning to users, or other disclosure in this file that this history will be read and returned.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This patch propagates the selected authentication profile identifier from backend runtime state into chat event payloads and UI rendering, including placing the raw profileId in a tooltip/title field and exposing auth mode via a callable gateway method. Even if the value is not a secret token, profile identifiers can reveal credential source, provider linkage, manual vs CLI/OAuth usage, or internal naming conventions, which creates unnecessary information disclosure and may aid account enumeration, fingerprinting, or social engineering in a multi-user or remotely accessible UI.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The External API Calls section says 'agents.wizard makes a single HTTP POST' and 'No other outbound calls.' Later sections describe additional behavior where the UI calls auth.status after each final chat event, and the skill also includes other runtime-integrated changes beyond the wizard. While auth.status is internal RPC rather than external internet traffic, the blanket 'No other outbound calls' statement overstates the limitation and can mislead about actual communication behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This TypeScript UI code renders a 'Session History' modal that exposes stored conversation messages, including user, system, and tool content, but there is no visible disclosure that the view may contain sensitive or private data. For code files, missing user warnings apply when user data is surfaced or affected without any confirmation, prompt, or explanatory notice, and no such notice appears in the modal text.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.