Security audit

Agent Communication

Security checks for vulnerabilities and agentic risk

Overview

This skill’s main purpose is coherent, but its bundled script can globally broaden cross-agent session access without clear disclosure or confirmation.

Install only if you intentionally want all OpenClaw sessions visible for cross-agent communication. Review the script before running it, prefer a dedicated OpenClaw profile without sensitive unrelated sessions, and keep the backup so you can restore the previous configuration.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/enable-cross-agent.sh:4
Finding: Global Configuration Enables Unrestricted Cross-Agent Session Visibility
Content: View full analysis
/tmp/openclaw_config.json # 验证 if [ $? -eq 0 ]; then mv /tmp/openclaw_config.json "$CONFIG_FILE" ``` ### Technical Analysis The script unconditionally changes the user-wide OpenClaw configuration by setting: ```json { "tools": { "sessions": { "visibility": "all" } } } ``` This expands session visibility globally rather than granting narrowly scoped access to only the agents required for a specific communication task. It violates the principle of least privilege because every component governed by this configuration may receive broader session access than its assigned function requires. The privilege expansion is not prominently disclosed in the primary `SKILL.md` documentation, and the script does not ask for confirmation, inspect the existing policy, or restrict visibility using an allowlist. Although the precise operations permitted by `visibility = "all"` depend on the OpenClaw runtime, the intended effect of the script is explicitly to enable cross-agent access to all sessions. ### Attack Path 1. A user installs the skill and runs `scripts/enable-cross-agent.sh`. 2. The script rewrites `$HOME/.openclaw/openclaw.json`, setting session visibility to `all`. 3. The user restarts the OpenClaw gateway as instructed by the script. 4. Any agent operating under this global configuration can attempt to discover or communicate with sessions outside the minimum set needed for its task. 5. A compromised, malicious, or incorrectly instructed agent can use this expanded access to target unrelated sessions. ### Impact Assessment The ...[truncated 504 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/enable-cross-agent.sh:10
Finding: Predictable Temporary File Permits Symlink Attacks and Configuration Races
Content: View full analysis
/tmp/openclaw_config.json # 验证 if [ $? -eq 0 ]; then mv /tmp/openclaw_config.json "$CONFIG_FILE" ``` ### Technical Analysis The script writes configuration data to the fixed, predictable path `/tmp/openclaw_config.json`. Shared temporary directories are commonly writable by multiple local users and processes. The shell opens this path for output before `jq` starts, without safely creating a new file and without checking whether the path already exists or is a symbolic link. An attacker able to create this path in advance could point it at another file writable by the victim. The redirection may then follow the symbolic link and truncate or replace the target's contents. Operating-system symlink protections can reduce exploitability on some systems, but the script must not rely on optional host-level mitigations. Concurrent invocations can also write to and move the same temporary path, causing one execution to consume another execution's output. The script has no cleanup trap, exclusive file creation, or permission enforcement. ### Attack Path 1. A local attacker predicts the fixed path `/tmp/openclaw_config.json`. 2. Before the victim runs the script, the attacker creates that path as a symbolic link to a file writable by the victim, or creates a conflicting regular file. 3. The victim executes `scripts/enable-cross-agent.sh`. 4. Shell redirection opens the predictable path and may follow the symbolic link, truncating the linked target before `jq` executes. 5. If `jq` succeeds, the script moves the attacker-controlled temporary path over `$HOME/.openclaw/openclaw.json`, potentially corrupting the OpenClaw configuration or leaving an unintended link or file in its place. ...[truncated 805 chars]
Remediation: View remediation
"$TEMP_FILE" jq empty "$TEMP_FILE" mv -- "$TEMP_FILE" "$CONFIG_FILE" trap - EXIT ``` The access-control issue should be addressed separately by replacing the unrestricted `all` policy with the narrowest supported policy. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The integration examples hard-code Chinese message content (e.g. "请研究...", "完成代码审查", and "内容") without offering a language choice or explaining a required locale. This can violate language/locale policy because the documentation implicitly prescribes a specific language for agent communication.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script directly modifies the user's OpenClaw configuration to enable tools.sessions.visibility = "all", which broadens cross-agent session access without any interactive confirmation, authorization check, or clear risk disclosure. In this skill context, that setting changes a security-relevant boundary and could expose session data to other agents, making the silent config change more dangerous than a routine preference update.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script's comments and user-facing echo output are written in Chinese only, which imposes a specific language on users without opt-in or documented locale justification. This matches the policy category for language or locale constraints expressed in natural-language content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.