Safe Update/Merge

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:46 AM UTC
• Version: 1.3.0

Overview

The skill is mostly a disclosed OpenClaw merge helper, but it adds high-impact repository and session controls with several unsafe or overstated safeguards.

Install only if you are comfortable reviewing and manually supervising a high-impact merge workflow. Run it in a disposable clone or VM first, prefer --dry-run and --no-auto-resolve for sensitive repositories, verify remotes and branches before --promote, and avoid installing the background-session panel unless you want operators to view and message cron/isolated agent sessions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/safe-merge-update.sh:284

Finding

Secret Redaction Fails Open Before External Model Transmission

Content

View full analysis

"$MAP_FILE" REDACTED=$("$REDACT_SCRIPT" "$file") exec 3>&- echo "$REDACTED" > "$file" REDACT_MAPS["$file"]="$MAP_FILE" done <<< "$CONFLICT_LIST" success "Secrets redacted. Maps held in ${REDACT_MAP_DIR} (mode 700, deleted after restore)." else warn "redact-secrets.sh not found — proceeding WITHOUT secret redaction." warn "Inspect conflicted files for secrets before continuing." fi ``` ### Technical Analysis The workflow treats secret redaction as optional even though it subsequently delegates conflict resolution to an external Claude Code process. If `redact-secrets.sh` is missing or lacks execute permission, execution continues instead of terminating or switching to manual resolution. This is a fail-open security design. The Skill documentation states that conflicted files are redacted before model transmission, but the implementation does not enforce that guarantee. Conflicted source or configuration files can contain API keys, access tokens, private keys, authenticated connection strings, or other confidential values. The warning does not provide an effective security boundary because the script is an automated workflow and does not pause for explicit operator confirmation. ### Attack Path 1. An attacker, packaging error, or local permissions change ca ...[truncated 1097 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/safe-merge-update.sh:338

Finding

Redacted Placeholders Are Committed Before Plaintext Values Are Restored

Content

View full analysis

"$file" fi done rm -rf "$REDACT_MAP_DIR" success "Secrets restored. Map directory deleted." fi ``` ### Technical Analysis The script stages and commits the conflict-resolution result while sensitive values are still represented by `[REDACTED_N]` placeholders. It restores the original values only after the commit has been created. Consequently, the committed safe-merge branch and the post-restoration working tree are different: - The Git commit contains redaction placeholders. - The working tree contains restored values as uncommitted modifications. - A build may test the restored working tree while promotion pushes the placeholder-containing commit. - Promotion mode does not verify that the working tree is clean or that the pushed revision is identical to the tested tree. This violates build reproducibility and can silently replace operational configuration or source literals with placeholders in the promoted branch. ### Attack Path 1. A merge conflict occurs in a file containing a value matched by `redact-secrets.sh`. 2. The script replaces that value with a placeholder such as `[REDACTED_1]`. 3. Claude re ...[truncated 1090 chars]

Remediation

View remediation

"$file" done # Validate the final content. if git grep -nE '\[REDACTED_[0-9]+\]' -- "${!REDACT_MAPS[@]}"; then fail "Unrestored placeholders remain." exit 1 fi if grep -R -nE '^(<<<<<<<|=======|>>>>>>>)' -- "${!REDACT_MAPS[@]}"; then fail "Conflict markers remain." exit 1 fi git add -- "${!REDACT_MAPS[@]}" git commit --no-edit git diff --quiet git diff --cached --quiet ``` Promotion should independently reject a dirty working tree and should prefer `--force-with-lease` over unconditional `--force`. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/safe-merge-update.sh:307

Finding

Claude Code Receives Repository-Wide Read Capability Beyond the Documented Scope

Content

View full analysis

>>>>>> markers) 2. Resolve each conflict per strategy using the Edit tool — write clean content with no conflict markers 3. When ALL files are resolved, reply with: CONFLICTS_RESOLVED Do NOT run any shell commands (git, npm, etc.) — the calling script handles those. Do NOT modify files that have no conflict markers. PROMPT )" ``` ### Technical Analysis The Skill documentation claims that only redacted conflicting file content is exposed to the model. However, Claude Code is launched from the repository and is granted the general `Read` and `Edit` tools. The prompt instructs the model to access only conflicted files, but prompt text is not a filesystem sandbox or enforceable access-control policy. A conflicted file can contain adversarial co ...[truncated 1845 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The repeated mismatch between declared two-phase merge behavior and unrelated or unverified functionality makes the skill materially misleading. In security terms, misleading packaging reduces an operator's ability to evaluate scope, approve the right permissions, and detect abuse before execution.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The repeated mismatch between declared two-phase merge behavior and unrelated or unverified functionality makes the skill materially misleading. In security terms, misleading packaging reduces an operator's ability to evaluate scope, approve the right permissions, and detect abuse before execution.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The repeated mismatch between declared two-phase merge behavior and unrelated or unverified functionality makes the skill materially misleading. In security terms, misleading packaging reduces an operator's ability to evaluate scope, approve the right permissions, and detect abuse before execution.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The repeated mismatch between declared two-phase merge behavior and unrelated or unverified functionality makes the skill materially misleading. In security terms, misleading packaging reduces an operator's ability to evaluate scope, approve the right permissions, and detect abuse before execution.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The repeated mismatch between declared two-phase merge behavior and unrelated or unverified functionality makes the skill materially misleading. In security terms, misleading packaging reduces an operator's ability to evaluate scope, approve the right permissions, and detect abuse before execution.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The repeated mismatch between declared two-phase merge behavior and unrelated or unverified functionality makes the skill materially misleading. In security terms, misleading packaging reduces an operator's ability to evaluate scope, approve the right permissions, and detect abuse before execution.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The repeated mismatch between declared two-phase merge behavior and unrelated or unverified functionality makes the skill materially misleading. In security terms, misleading packaging reduces an operator's ability to evaluate scope, approve the right permissions, and detect abuse before execution.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The documented workflow includes git push --force to overwrite the target branch. Force-push is inherently high impact because it can destroy remote history, overwrite collaborators' work, and make rollback harder; in a skill with broad or ambiguous invocation semantics, this becomes especially dangerous.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

| `npm run build` / `pnpm run build` | Phase 1 | Downloads packages if lockfile changed (network); builds in place |
| `systemctl --user restart openclaw-gateway` | Phase 1 | **Restarts the live gateway** — brief downtime; gateway now runs from safe-merge build |
| Conflict resolution via `claude` CLI | Phase 1 (optional) | Passes **redacted** file content to the Claude API; `Edit`+`Read` tools only — **`Bash` explicitly excluded** |
| `git push --force` to `TARGET_REMOTE/TARGET_BRANCH` | **Phase 2 only** (`--promote`) | **Overwrites remote branch** — only runs after user confirms gateway is healthy |
| `git branch -D safe-merge-*` | **Phase 2 only** (`--promote`) | Deletes temp branch after successful promotion |

### Prerequisites

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

The model sees only the **redacted content** of conflicted files (see Secret Redaction below) — not the entire repository.

To control which Claude model is used, configure it in your `~/.claude/config.json` or set the model via claude CLI flags.

### Secret Redaction

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The explicit git push myfork ... --force command can irreversibly overwrite the target branch on the remote fork. In combination with the description/behavior mismatch elsewhere, an operator may not fully appreciate that approving this skill can lead to destructive remote state changes outside a normal review workflow.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md

**Phase 2 (user-confirmed via `--promote`):**
1. User verifies gateway is healthy
2. `git push myfork safe-merge-YYYY-MM-DD:local-desktop-main --force`
3. `git checkout local-desktop-main && git reset --hard safe-merge-YYYY-MM-DD`
4. `git branch -D safe-merge-YYYY-MM-DD`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

git reset --hard discards local changes and forcibly rewrites the working tree to match the merge branch. This is dangerous because any uncommitted local work or unexpected branch context can be lost, and in an automated or agent-driven flow this can happen faster than an operator can intervene.

Content

Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.

md

**Phase 2 (user-confirmed via `--promote`):**
1. User verifies gateway is healthy
2. `git push myfork safe-merge-YYYY-MM-DD:local-desktop-main --force`
3. `git checkout local-desktop-main && git reset --hard safe-merge-YYYY-MM-DD`
4. `git branch -D safe-merge-YYYY-MM-DD`

**Rollback before confirming:** gateway restart reverts to previous build; `local-desktop-main` was never touched.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.

md

| `SKILL.md` | This file — skill instructions |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 349)May include surrounding context.

md

| `references/bg-sessions-backend.ts` | Reference: `src/gateway/server-methods/bg-sessions.ts` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 350)May include surrounding context.

md

| `references/bg-sessions-controller.ts` | Reference: `ui/src/ui/controllers/bg-sessions.ts` |

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file contains substantial background-session monitoring and messaging functionality unrelated to merge automation. This unjustified expansion of scope is dangerous because it grants observability and interaction over other agent sessions, which may contain sensitive prompts, outputs, tool arguments, or credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documented behavior allows listing background or cron sessions, reading their history, and sending messages through chat.send. For a merge-update skill, that is a clear privilege overreach and can enable cross-session data exfiltration or unauthorized command injection into other running agent contexts.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

Even though the target path is narrower than root, rm -rf /tmp/safe-merge/ is still a destructive shell pattern included in user-facing instructions. In a skill already mixing unrelated capabilities, encouraging manual destructive cleanup increases operational risk and can be abused through path substitution or mistaken execution.

Content

Scanner excerpt · SKILL.md (reported line 479)May include surrounding context.

text

3. Run `openclaw gateway restart` — pick up the new build
4. Check config schema compatibility — upstream may add `.strict()` to schemas
5. Clean up backups: `rm -rf /tmp/safe-merge/` — while backups are redacted, remove them when no longer needed

## Changelog

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

Even though the target path is narrower than root, rm -rf /tmp/safe-merge/ is still a destructive shell pattern included in user-facing instructions. In a skill already mixing unrelated capabilities, encouraging manual destructive cleanup increases operational risk and can be abused through path substitution or mistaken execution.

Content

Scanner excerpt · SKILL.md (reported line 479)May include surrounding context.

text

3. Run `openclaw gateway restart` — pick up the new build
4. Check config schema compatibility — upstream may add `.strict()` to schemas
5. Clean up backups: `rm -rf /tmp/safe-merge/` — while backups are redacted, remove them when no longer needed

## Changelog

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

Even though the target path is narrower than root, rm -rf /tmp/safe-merge/ is still a destructive shell pattern included in user-facing instructions. In a skill already mixing unrelated capabilities, encouraging manual destructive cleanup increases operational risk and can be abused through path substitution or mistaken execution.

Content

Scanner excerpt · SKILL.md (reported line 479)May include surrounding context.

text

3. Run `openclaw gateway restart` — pick up the new build
4. Check config schema compatibility — upstream may add `.strict()` to schemas
5. Clean up backups: `rm -rf /tmp/safe-merge/` — while backups are redacted, remove them when no longer needed

## Changelog

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The promote flow performs a force-push to a remote and both TARGET_REMOTE and TARGET_BRANCH are environment-variable controlled. If those values are mis-set or attacker-influenced, the script can overwrite an unintended remote branch, causing destructive integrity loss of repository history or pushing merged code to the wrong destination.

Content

Scanner excerpt · scripts/safe-merge-update.sh (reported line 155)May include surrounding context.

sh

echo "  and delete the local ${PROMOTE_BRANCH} branch."
  echo ""

  git push "$TARGET_REMOTE" "${PROMOTE_BRANCH}:${TARGET_BRANCH}" --force
  success "Pushed to ${TARGET_REMOTE}/${TARGET_BRANCH}"

  git checkout "$TARGET_BRANCH"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The script checks out TARGET_BRANCH and then hard-resets it to PROMOTE_BRANCH, which discards local history and working-tree state on the target branch. Although the script enforces a clean working tree earlier in the main flow, this operation remains destructive and can be redirected via environment-controlled branch names or misused to overwrite the wrong branch locally.

Content

Scanner excerpt · scripts/safe-merge-update.sh (reported line 159)May include surrounding context.

sh

success "Pushed to ${TARGET_REMOTE}/${TARGET_BRANCH}"

  git checkout "$TARGET_BRANCH"
  git reset --hard "$PROMOTE_BRANCH"
  git branch -D "$PROMOTE_BRANCH"

  # Clear the Phase 2 pending state file so the UI stops showing the prompt

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The script sends conflicted file contents to an external Claude provider for automated merge resolution. Even with Read/Edit-only tool restrictions and attempted redaction, repository contents may still contain proprietary code, secrets missed by redaction, or sensitive context that is exfiltrated to a third party during conflict handling.

Content

Scanner excerpt · scripts/safe-merge-update.sh (reported line 311)May include surrounding context.

sh

info "Invoking claude to resolve ${CONFLICT_COUNT} conflict(s)…"
  # Bash tool intentionally excluded — the script commits after claude exits.
  # Claude can only read and edit files; no shell execution granted.
  claude --allowedTools "Edit,Read" --print "$(cat <<PROMPT
You are resolving git merge conflicts in the OpenClaw repository at ${REPO_DIR}.
Branch: ${SAFE_BRANCH}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares no explicit tool scope even though the documented workflow requires shell execution and file modification. In an agent ecosystem, missing permission boundaries increases the chance the skill is run with broader capabilities than intended, which is dangerous because this skill includes destructive operations like force-push, hard reset, branch deletion, and service restart.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

- name: "claude"
          description: "Claude Code CLI — only required for --auto-resolve conflict resolution. Install: npm i -g @anthropic-ai/claude-code"
        - name: "python3"
          description: "Used by preflight.sh to write the JSON report. Available by default on most Linux/macOS systems."
        - name: "systemctl"
          description: "Used to restart the gateway after a successful merge (systemctl --user restart openclaw-gateway). Required only on systemd-based Linux hosts."
      env:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The skill explicitly states that redaction maps containing the information needed to restore secrets are written to disk, even if in a mode-700 temp directory. Persisting secret restoration material on disk expands exposure through local compromise, backups, forensic recovery, or accidental retention if cleanup fails; this context is more dangerous because the skill processes credentials from conflicted files.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

Detected secrets are replaced with [REDACTED_N] placeholders.

How the map is stored: redact-secrets.sh requires fd 3 to be open and writes the redaction map to whatever file fd 3 points to. In safe-merge-update.sh, fd 3 is wired to a per-file temp file inside a mode-700 temp directory (mktemp -d). So the map is written to disk — in a private, process-owned temp directory — and deleted immediately after secret restoration. It is never written to stdout, stderr, or any shared/world-readable path.

If your security policy requires no disk writes, mount the temp dir on a tmpfs:

bash

Static analysis

No suspicious patterns detected.