ClawHub
Back to skill

Security audit

ClawCheck

Security checks for vulnerabilities and agentic risk

Overview

ClawCheck is a local OpenClaw audit skill that reads configuration, cron, skill, and workspace files to report security and quality issues, with no evidence of exfiltration, persistence, or mutation.

Install this only if you want a local OpenClaw audit and are comfortable with the script and agent reading OpenClaw config, cron prompts, skill files, .env file paths, and selected workspace content. For a lower-exposure check, run Phase 1 only; for a full audit, avoid workspaces containing customer data or real secrets unless you are comfortable with relevant content entering the active agent/model context.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/audit.py:128
Finding

Overly Broad Access to Sensitive OpenClaw Files

Content
View full analysis
= 500: break files_scanned += 1 try: content = fp.read_text(errors="replace")[:16384] except OSError: continue for pattern, label in secret_patterns: if re.search(pattern, content): rel = str(fp.relative_to(oc_dir)) workspace_secrets.append((rel, label)) break # one finding per file ``` The scanner also recursively enumerates `.env` files across the entire OpenClaw state directory: ```python env_files = list(oc_dir.rglob(".env")) if env_files: gitignore = oc_dir / ".gitignore" protected = False if gitignore.is_file(): try: protected = ".env" in gitignore.read_text() except OSError: pass ``` The full-audit instructions further direct the agent to inspect sensitive configuration, cron prompts, credentials, and workspace knowledge: ```text Read ~/.openclaw/opencla ...[truncated 3336 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

md
| Module | Weight | What it catches |
|--------|--------|-----------------|
| Security | 30% | Inline secrets in env.vars, plaintext bot tokens, unprotected .env files |
| Cron | 25% | Error states, stale jobs, schedule conflicts, missing timezones |
| Config | 20% | Missing heartbeat, no fallbacks, no session maintenance, no compaction |
| Skills | 25% | Broken frontmatter, missing dependencies, structural quality scoring |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/remediation.md (reported line 62)May include surrounding context.

md
| Module | Weight | What it catches |
|--------|--------|-----------------|
| Security | 30% | Inline secrets in env.vars, plaintext bot tokens, unprotected .env files |
| Cron | 25% | Error states, stale jobs, schedule conflicts, missing timezones |
| Config | 20% | Missing heartbeat, no fallbacks, no session maintenance, no compaction |
| Skills | 25% | Broken frontmatter, missing dependencies, structural quality scoring |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/remediation.md (reported line 68)May include surrounding context.

md
| Module | Weight | What it catches |
|--------|--------|-----------------|
| Security | 30% | Inline secrets in env.vars, plaintext bot tokens, unprotected .env files |
| Cron | 25% | Error states, stale jobs, schedule conflicts, missing timezones |
| Config | 20% | Missing heartbeat, no fallbacks, no session maintenance, no compaction |
| Skills | 25% | Broken frontmatter, missing dependencies, structural quality scoring |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/remediation.md (reported line 70)May include surrounding context.

md
| Module | Weight | What it catches |
|--------|--------|-----------------|
| Security | 30% | Inline secrets in env.vars, plaintext bot tokens, unprotected .env files |
| Cron | 25% | Error states, stale jobs, schedule conflicts, missing timezones |
| Config | 20% | Missing heartbeat, no fallbacks, no session maintenance, no compaction |
| Skills | 25% | Broken frontmatter, missing dependencies, structural quality scoring |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 132)May include surrounding context.

python
| Module | Weight | What it catches |
|--------|--------|-----------------|
| Security | 30% | Inline secrets in env.vars, plaintext bot tokens, unprotected .env files |
| Cron | 25% | Error states, stale jobs, schedule conflicts, missing timezones |
| Config | 20% | Missing heartbeat, no fallbacks, no session maintenance, no compaction |
| Skills | 25% | Broken frontmatter, missing dependencies, structural quality scoring |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 146)May include surrounding context.

python
| Module | Weight | What it catches |
|--------|--------|-----------------|
| Security | 30% | Inline secrets in env.vars, plaintext bot tokens, unprotected .env files |
| Cron | 25% | Error states, stale jobs, schedule conflicts, missing timezones |
| Config | 20% | Missing heartbeat, no fallbacks, no session maintenance, no compaction |
| Skills | 25% | Broken frontmatter, missing dependencies, structural quality scoring |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md
- Check if any skill `scripts/` contain hardcoded credentials or API URLs with embedded tokens
- Check if `.env` files exist inside skill directories
- Look for credentials in cron job prompts (some prompts inline API keys instead of referencing env vars)
- Check if any workspace knowledge files contain customer data, passwords, or access tokens

## Output Format

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 133)May include surrounding context.

python
))

    # 5. .env files without .gitignore
    env_files = list(oc_dir.rglob(".env"))
    if env_files:
        gitignore = oc_dir / ".gitignore"
        protected = False

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 139)May include surrounding context.

python
))

    # 5. .env files without .gitignore
    env_files = list(oc_dir.rglob(".env"))
    if env_files:
        gitignore = oc_dir / ".gitignore"
        protected = False

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 167)May include surrounding context.

python
))

    # 5. .env files without .gitignore
    env_files = list(oc_dir.rglob(".env"))
    if env_files:
        gitignore = oc_dir / ".gitignore"
        protected = False

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 147)May include surrounding context.

python
findings.append(finding(
                "warning", "security",
                f"{len(env_files)} .env file(s) found without .gitignore protection",
                "Add '.env' to .gitignore"
            ))

    # 6. Secrets in workspace files (markdown, scripts, JSON, YAML)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The remediation example hard-codes "tz": "Europe/Madrid", which imposes a specific locale setting in natural-language guidance without indicating that users should choose an appropriate timezone for their region. Under the policy, forcing a locale without opt-in or clear region-specific justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The header presents the script as a self-contained audit with stdlib-only behavior, but later code inspects PATH via shutil.which and enumerates /usr/local/Cellar/node to inspect bundled skills. While this does not contradict the 'stdlib only' implementation claim, it does contradict the implied scope of auditing just the OpenClaw installation by reaching into broader host environment state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.