Sysclaw Ops

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:31 AM UTC
• Version: 1.6.2

Overview

The skill is transparent about being an ops automation agent, but it can repeatedly approve and execute infrastructure changes over SSH from database requests without sufficiently tight controls.

Install only for a dedicated SysClaw operator with tightly restricted DB and SSH credentials. Before enabling the recurring job, add host/package/service/path allowlists, typed request schemas, requester-to-target authorization checks, human approval for deployments, service mutations, resource creation, and software changes, and fix the documented worklog database grants.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:143

Finding

Untrusted Agent Requests Can Trigger Insufficiently Constrained Infrastructure Operations

Content

View full analysis

; -- 2. Assess and update verdict UPDATE agent_requests SET verdict = 'approved', security_assessment = 'Low risk: standard package install on managed VM', resolved_at = NOW(), resolved_by = 'sysclaw' WHERE id = ; -- 3. Log to worklog INSERT INTO worklog (request_id, action, target, command, status) VALUES (, '', '', '', 'in_progress'); -- 4. Execute the action (SSH to target, run command, verify) -- 5. Update worklog with result UPDATE worklog SET status = 'completed', result = '', completed_at = NOW() WHERE id = ; -- 6. Write response notification back to agent INSERT INTO notifications (recipient, sender, related_request, message, urgency) VALUES ('jobhunter', 'sysclaw', , 'Request #5 DONE: cron installed and verified on MB-OpenClaw-01', 'normal'); -- 7. Mark sysclaw's notification as read UPDATE notifications SET read = TRUE WHERE id = ; ``` ```markdown ### Execution by Request Type | Request type | Action | |---|---| | `info` | SSH to target, run check, write result to worklog + notification | | `software` | SSH to target, install package, verify service running | | `config` | SSH to target, apply config change, verify | | `service` | SSH to target, restart/stop/start service, verify status | | `resource` | Create DB/user/allocation if SysClaw has access; escalate infrastructure requests | | `deployment` | SSH to target, deploy per request details, verify | | `access` | **Escalate to human operator** — never auto-approved | ``` ```markdown ## Cron Job Behavior The `sysclaw-notification-check` OpenClaw cron job ru ...[truncated 3964 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md

**Deny:**
- Requests without clear justification
- Dangerous operations (rm -rf, chmod 777)
- Conflicts with security policy

## Cron Job Behavior

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match ordinary operational language, which increases the chance this skill activates in unintended contexts. Because the skill authorizes database updates, SSH-based actions, and request processing, accidental invocation could lead to unintended approvals or infrastructure changes.

Content

No source excerpt is available for this finding.

Scope Creep

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented workflow requires INSERT/UPDATE operations on the worklog table, but the declared minimal privileges omit any access to that table. This mismatch can cause the agent to fail open or operators to grant broader ad hoc database permissions than intended, weakening least-privilege controls and audit reliability.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The skill explicitly allows SysClaw to autonomously approve and execute certain requests, including software, config, service, resource, and deployment actions over SSH. Even with stated guidelines, autonomous execution on infrastructure creates a meaningful risk of unsafe changes, abuse through crafted requests, or misclassification of high-risk operations as low-risk.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md

| `service` | SSH to target, restart/stop/start service, verify status |
| `resource` | Create DB/user/allocation if SysClaw has access; escalate infrastructure requests |
| `deployment` | SSH to target, deploy per request details, verify |
| `access` | **Escalate to human operator** — never auto-approved |

### Escalate to the human operator

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

The decision guidelines authorize automatic approval for multiple categories of requests based on qualitative risk judgments. In this skill's context, auto-approved actions can result in SSH commands, package installation, configuration changes, and service manipulation, so mistakes in classification or maliciously framed requests could directly impact managed systems.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

md

## Decision Guidelines

**Auto-approve (low risk):**
- Software installs on managed VMs (standard packages)
- Info/check requests (disk, service status)
- Config changes to agent's own workspace

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md

**Deny:**
- Requests without clear justification
- Dangerous operations (rm -rf, chmod 777)
- Conflicts with security policy

## Cron Job Behavior

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · references/db-schema.md (reported line 27)May include surrounding context.

md

**Indexes:** severity, source, status, source_host

**Agent permissions:** INSERT + SELECT only. Do not UPDATE status — SysClaw owns this.

## Table: agent_requests

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · references/db-schema.md (reported line 65)May include surrounding context.

md

**Indexes:** severity, source, status, source_host

**Agent permissions:** INSERT + SELECT only. Do not UPDATE status — SysClaw owns this.

## Table: agent_requests

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · references/db-schema.md (reported line 82)May include surrounding context.

md

**Indexes:** severity, source, status, source_host

**Agent permissions:** INSERT + SELECT only. Do not UPDATE status — SysClaw owns this.

## Table: agent_requests

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · references/db-schema.md (reported line 101)May include surrounding context.

md

**Indexes:** severity, source, status, source_host

**Agent permissions:** INSERT + SELECT only. Do not UPDATE status — SysClaw owns this.

## Table: agent_requests

Static analysis

No suspicious patterns detected.