Security audit

OpenClaw Expert Guide

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only OpenClaw guide, but it includes copy-paste commands and sensitive provider/workspace guidance that need careful review before use.

Install only if you are comfortable with your agent using this as operational OpenClaw reference material. Before running commands it suggests, verify remote installers from official sources, avoid piping scripts directly into a shell, review any rm -rf cleanup, do not push workspace or memory files to a remote without inspecting them, and treat provider keys, voice data, remote code execution, and gateway tokens as sensitive.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The documentation explicitly states that OpenClaw adds identifying OpenRouter headers such as `HTTP-Referer`, `X-OpenRouter-Title`, and `X-OpenRouter-Categories`, but it does not warn users that these values disclose client metadata to a third-party service. In a privacy/security-sensitive tool, silent metadata disclosure is a real issue because it can leak deployment identity, product usage, or organizational attribution beyond what users may expect.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The xAI provider documentation advertises remote code execution capability without an explicit warning that code may run on third-party infrastructure and that submitted code and data may leave the local environment. That omission is dangerous because users may enable the feature assuming local execution, exposing sensitive source code, secrets, or data to an external provider.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The document instructs users to pipe a remote script directly into bash/PowerShell without any integrity verification, pinning, or warning about the trust boundary. If the hosting site, TLS chain, or delivery path is compromised, users would execute attacker-controlled code immediately during installation.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The uninstall section contains destructive deletion commands for state, workspace, and application files but does not clearly warn that this removes user data, credentials, sessions, and configuration. This creates a real risk of accidental irreversible data loss, especially in copy-paste driven documentation.

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.prompt_injection_instructions, suspicious.secret_argv_exposure

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: references/09-installation.md:484

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/04-channels.md:561

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: references/09-installation.md:278