ClawHub
Back to skill

Security audit

OpenClaw QuickRef

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only OpenClaw quick reference, with some caution needed around broad activation wording and examples for destructive commands or API keys.

Install only if you want Chinese OpenClaw CLI/configuration quick-reference help. Treat destructive examples such as session deletion, plugin removal, and config unset as user-confirmed actions, and avoid placing real API keys directly in shell commands.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill description uses broad trigger language such as asking how to configure something or what a command is, which can match many ordinary requests outside the intended OpenClaw context. This can cause accidental invocation, leading the agent to apply irrelevant instructions or answer from this skill when a different tool or safer behavior would be more appropriate.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The activation conditions are vague and rely on generic phrases like '怎么配置 X' and '命令是什么', without requiring product-specific context. In an agent system, ambiguous routing increases the chance of prompt/skill misselection, which can produce incorrect guidance, override better-matched skills, or expose users to unsafe command suggestions in the wrong context.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
This markdown file describes commands that delete sessions, remove plugins, and unset configuration values, but it provides no cautionary note about data loss, reversibility, or operational impact. Under the markdown-specific warning criterion, potentially user-affecting or system-integrity-affecting behaviors should be disclosed.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The example shows setting an API key directly on the command line, which can expose the credential through shell history, process listings, terminal logs, or recorded session transcripts. In a quick-reference skill, users may copy and paste this pattern directly, making accidental secret disclosure more likely.

External Transmission

Medium
Category
Data Exfiltration
Content
"providers": {
    "openai": {
      "apiKey": "${OPENAI_API_KEY}",
      "baseUrl": "https://api.openai.com/v1",
      "models": ["gpt-4", "gpt-4-turbo", "gpt-3.5-turbo"]
    }
  }
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
"providers": {
    "my-custom": {
      "apiKey": "${MY_API_KEY}",
      "baseUrl": "https://api.example.com/v1",
      "headers": {
        "X-Custom-Header": "value"
      }
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low
Confidence
77% confidence
Finding
The manifest description and trigger examples are entirely in Chinese, which implies a language-specific interaction model. There is no statement that the user may choose another language or that the Chinese-only scope is intentional and justified.

Natural-Language Policy Violations

Low
Confidence
80% confidence
Finding
A file-wide natural-language policy concern exists because the skill documentation appears to force a specific language without offering user opt-in or stating that the content is intended for a Chinese-language audience. The provided policy requires flagging language or locale constraints that are not optional or justified.

Natural-Language Policy Violations

Low
Confidence
88% confidence
Finding
This markdown file appears to force a specific language for all readers, and no alternate language option or justification for a Chinese-only audience is provided. Under the policy, language constraints should be optional or clearly documented as region-specific.

Static analysis

No suspicious patterns detected.