Security audit

Create Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an agent-creation helper, but it includes unsafe token-copying guidance and broad local write behavior that users should review before installing.

Install only if you understand that this skill will persistently change your OpenClaw agent files, workspace files, openclaw.json, and TEAM.md. Prefer dry-run first, avoid running it as root, use only trusted workspace paths, and do not follow the browser-token extraction guide; use an official scoped token or supported login flow and keep secrets out of shell history and source control.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/create_agent.py:550
Finding: Unvalidated Agent and Workspace Paths Allow Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: GET_TOKEN.md:88
Finding: Authentication Token Exposed Through Command-Line Arguments
Content: View full analysis
--label "server-cli" ``` ### Technical Analysis The guide recommends placing a ClawHub authentication token directly in a command-line argument. The same guide identifies this token as password-equivalent. Command-line secrets can be recorded in shell history, terminal logs, audit records, process accounting, or automation logs. Depending on operating-system process visibility and user isolation, another local user may also be able to inspect the argument while the command is running. Although the CLI may legitimately support `--token`, documenting direct token substitution encourages credential handling that leaves avoidable plaintext traces. ### Attack Path 1. A user follows the documented login command and substitutes a real token for the placeholder. 2. The shell records the full command in history, or another logging or process-monitoring facility captures its arguments. 3. A local attacker, support operator, backup reader, or log reader obtains access to that record. 4. The attacker extracts the ClawHub token. 5. The attacker uses the token until it expires or is revoked. ### Impact Assessment A recovered token may permit actions available to the associated ClawHub account, potentially including authentication, publication of Skills, or modification of published content. The exact scope depends on the permissions assigned to the token. Exploitation generally requires local access, access to shell or audit logs, or another ability to observe command-line arguments. This limits the severity but does not eliminate the credential-exposure risk. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document gives step-by-step instructions for extracting live authentication tokens from browser network traffic, cookies, and local storage, then reusing them on another server. Even though it briefly says tokens are like passwords near the end, the core behavior is credential harvesting and reuse, which materially increases the risk of account compromise, session theft, and unauthorized access.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: These instructions explicitly direct the user to locate and copy authentication material from browser headers, cookies, storage, or account pages and then use it on a server for CLI publishing. In a skill context, that normalizes credential exfiltration and cross-environment reuse, which can enable unauthorized publishing, account takeover, or secret leakage if followed by someone without a clear security boundary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The document presents all instructions in Chinese with no indication that language selection is optional or context-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless clearly justified.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · GET_TOKEN.md (reported line 25)May include surrounding context.
md
- 在左侧请求列表中找包含 `api` 的请求 - 常见 URL 模式： - `https://clawhub.ai/api/...` - `https://api.clawhub.ai/...` - `https://clawhub.biz/api/...` **6. 查看请求头**

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation explicitly advertises automatic generation of agent files and updates to shared configuration such as openclaw.json and TEAM.md, but it does not prominently warn users that running the skill will perform local writes and mutate shared state. In a setup tool, undisclosed write behavior increases the risk of accidental configuration changes, overwriting existing data, or introducing unauthorized agent/binding entries through routine use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README states that the skill will automatically create agent directories and modify shared configuration files such as openclaw.json and TEAM.md, but it does not warn users about overwrite risk, merge conflicts, or unintended changes to existing local state. In an agent-management context, silent modification of global config and workspace files can disrupt other agents, corrupt configuration, or cause users to lose existing settings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README instructs users to place bot tokens and app secrets into configuration or environment variables, but it does not include guidance on protecting those credentials from disclosure, accidental commits, or insecure storage. Because these secrets grant control over external messaging integrations, mishandling them could lead to account compromise, impersonation, or abuse of connected channels.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language content of the skill description, usage instructions, warnings, and troubleshooting is presented exclusively in Chinese. This can violate a language or locale policy when no user opt-in or explicit region-specific scope is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script writes USER.md with a fixed communication language of 中文, which imposes a specific language preference on the generated agent configuration. This is a natural-language locale policy issue because the file does not offer any user choice or indicate that the language setting is optional or region-specific.
Content: No source excerpt is available for this finding.

Tainted flow: 'workspace_dir' from input (line 600, user input) → shutil.copy (file write)

Medium

Category: Data Flow
Confidence: 92% confidence
Finding: The script accepts a user-controlled --workspace path and later copies generated files into that location without constraining it to an approved base directory or checking for symlinks. When run with elevated privileges, an attacker or mistaken operator could overwrite files in arbitrary locations, including sensitive system or application paths, causing configuration corruption or privilege-impacting file placement.
Content: Scanner excerpt · scripts/create_agent.py (reported line 622)May include surrounding context.
python
if not args.dry_run: import shutil for f in ['IDENTITY.md', 'SOUL.md', 'AGENTS.md', 'USER.md']: shutil.copy(agent_dir / f, workspace_dir / f) log(f" 同步到工作区", 'success') # 3. 更新 openclaw.json

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: Natural-language policy issues include forcing a specific language without user opt-in. This file presents all operational instructions in Chinese and does not state that the skill is region-specific or provide an alternative language option.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language content of the README is exclusively Chinese, including setup and operational instructions. Under the policy rule, forcing a specific language without user opt-in or a documented justification is a locale-policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.