ClawHub
Back to skill

Security audit

ohmyopenclaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly setup guidance, but it recommends unsafe remote installers and enables broad persistent automation that can scan local data, spawn workers, and send reports.

Install only if you are comfortable reviewing and manually applying the guides. Do not run the pipe-to-shell installer as written; download, inspect, and verify installers first. Keep monitoring, autoSpawn, autoRecover, webhooks, and memory indexing disabled until you have chosen exact paths, destinations, retention rules, and approval gates. Store provider API keys with restrictive permissions or a secret manager.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:64
Finding

Remote Installer Scripts Are Executed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Error
Location
guides/monitor.md:95
Finding

Persistent Autonomous Monitoring and Worker Execution Are Enabled

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
guides/monitor.md:112
Finding

Monitoring Configuration Permits Broad Log Access and Outbound Reporting

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
guides/chinese-providers.md:110
Finding

Provider API Credentials Are Stored in a Plaintext Environment File Without Required Access Controls

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (33)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The command fetches a remote script and executes it directly via bash, which gives the remote endpoint immediate control over the local system. In the context of an AI skill that encourages automated setup, this is more dangerous because users may run the command with reduced scrutiny and the agent may normalize unsafe execution patterns.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

bash
# macOS / Linux
curl -fsSL https://get.ohmyopenclaw.dev | bash

# Windows PowerShell
irm https://get.ohmyopenclaw.dev/install.ps1 | iex

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The | bash pattern is a classic chaining-abuse primitive because it combines network retrieval and execution into a single step with no inspection barrier. If the fetched content is altered or malicious, it results in immediate arbitrary command execution, and the surrounding skill text encourages automated application of setup actions, which amplifies the risk.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

bash
# macOS / Linux
curl -fsSL https://get.ohmyopenclaw.dev | bash

# Windows PowerShell
irm https://get.ohmyopenclaw.dev/install.ps1 | iex

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · guides/agent-swarm.md (reported line 248)May include surrounding context.

I need to implement 3 API endpoints:

  1. GET /users - list users
  2. POST /users - create user
  3. DELETE /users/:id - delete user

Spawn separate workers for each endpoint.

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill states that guides can be read and applied automatically, and later says the AI will execute configuration changes and update workspace files, but it does not clearly warn users up front that local files and system state may be modified. In an agent-skill context, that omission increases the chance that a user authorizes actions without understanding the side effects, especially when setup guides may contain commands and file edits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The installation section recommends pipe-to-shell and pipe-to-iex commands that execute remote content immediately, without any safety warning or verification guidance. This is dangerous because a compromised server, repo, DNS path, or MITM-adjacent trust failure could result in arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file presents the skill guidance primarily in Chinese while embedding some English technical terms, but it does not give users an option to choose language or explain that the guide is intentionally region- or locale-specific. Under SQP-3, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guide presents general-purpose delegation across multiple external AI workers for code generation, CLI tasks, and system operations, which goes beyond simple setup documentation. That increases the risk that users enable broad capabilities without understanding that workers may modify code, run commands, or act on incomplete context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This setup guide crosses from configuration into enabling autonomous task execution, recovery, and proactive spawning of agents. In a skill intended for OpenClaw configuration, instructing the system to discover work and spawn workers autonomously expands operational scope and can cause unreviewed actions on user projects, making misuse or accidental damage more likely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
79% confidence
Finding

Creating persistent task directories under ~/.openclaw/workspace/.tasks/ establishes durable state for worker coordination and session continuity. Persistence itself is not malicious, but in this context it supports autonomous background orchestration and can retain sensitive prompts, task metadata, or stale state across sessions without clear retention guidance.

Content

Scanner excerpt · guides/agent-swarm.md (reported line 143)May include surrounding context.

2. 创建任务目录

bash
mkdir -p ~/.openclaw/workspace/.tasks/active
mkdir -p ~/.openclaw/workspace/.tasks/completed

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · guides/agent-swarm.md (reported line 206)May include surrounding context.

2. 验证目录结构

bash
ls -la ~/.openclaw/workspace/.tasks/

Expected:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The troubleshooting advice recommends killing workers and moving task files between state directories without caution about corruption, race conditions, or lost work. In a task-orchestration system, manual state manipulation can desynchronize task tracking and cause duplicate execution or data loss.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · guides/chinese-providers.md (reported line 93)May include surrounding context.

md
},
    "deepseek": {
      "apiKey": "${DEEPSEEK_API_KEY}",
      "baseUrl": "https://api.deepseek.com/v1"
    }
  },
  "model": {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide instructs users to place multiple live API credentials into a plaintext ~/.openclaw/.env file but does not mention file permissions, secret storage, rotation, or avoiding commits/logging. This increases the chance of credential disclosure through permissive filesystem access, backups, shell history, or accidental inclusion in repositories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The provider-selection rules automatically route Chinese-language requests to China-based providers without explicit user consent or a privacy warning. This can cause sensitive prompts or source code to be sent to a different third-party processor based solely on language, creating data-governance, compliance, and user-expectation risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · guides/chinese-providers.md (reported line 268)May include surrounding context.

md
"api": {
    "minimax": {
      "apiKey": "${MINIMAX_API_KEY}",
      "baseUrl": "https://api.minimax.chat/v1"
    }
  }
}

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The content consistently instructs the user in Chinese and does not provide an opt-in, alternative language, or justification that the skill is intended only for a Chinese-speaking or region-specific audience. This can violate language/locale policy when a skill effectively forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file clearly describes writing to openclaw.json, workspace/AGENTS.md, and creating ~/.openclaw/scripts/check-costs.sh, which can affect user configuration and local system behavior. Under the markdown-specific warning requirement, the document should disclose that following the guide changes local files and may alter model-selection, logging, and automation behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide enables semantic search over past conversations and cross-session knowledge retrieval, which implies persistent storage and later reuse of potentially sensitive user or project content. Without an explicit warning, consent step, or data-handling guidance, users may unknowingly retain secrets, proprietary code context, or personal data in searchable memory.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The guide describes automatically summarizing, storing, and archiving session content into MEMORY.md and .memory/archive without warning that user and project data will be written to persistent local storage. This creates a real risk of unintentionally retaining credentials, confidential design decisions, or regulated data beyond the active session.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
92% confidence
Finding

The session persistence behavior explicitly preserves key context and stores it in MEMORY.md, reinforcing that conversation-derived data survives beyond the current interaction. In an agent skill context, this is more dangerous because users may assume conversational context is ephemeral, while the guide operationalizes retention and later retrieval without clear safety boundaries.

Content

Scanner excerpt · guides/memory-optimized.md (reported line 45)May include surrounding context.

md
│     └─ Extract decisions            │
│                                     │
│  3. Summarize                       │
│     ├─ Create concise summary       │
│     ├─ Preserve key context         │
│     └─ Store in MEMORY.md           │
│                                     │

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide goes beyond passive OpenClaw configuration and explicitly promotes autonomous discovery, handling, and recovery of tasks. In a skill marketed as configuration/setup guidance, this materially expands operational scope and can cause the agent to initiate actions the user may not expect, including workflow changes and autonomous execution paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide states that it will modify configuration and workspace files and later describes task creation, agent spawning, and auto-recovery, but it does not prominently warn users about these automated changes. This can lead to unintended persistent modifications and autonomous actions in the user's environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The configuration instructs the system to scan application logs at /var/log/myapp, which may contain sensitive operational, user, or credential material. For a setup guide, directing monitoring of system log paths without clear justification or scoping creates unnecessary access to potentially sensitive host data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide enables outbound notification channels and webhook delivery that can transmit monitoring findings off-system. Without privacy and security controls, logs, error details, task metadata, or code-derived information could be exfiltrated to email, Discord, Slack, or arbitrary callback endpoints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

External channels and webhooks are configured without an explicit warning that monitoring data may leave the local environment. Users may unknowingly send internal logs, repository metadata, or operational details to third-party services, creating confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.