ClawHub
Back to skill

Security audit

test

Security checks for vulnerabilities and agentic risk

Overview

This audit skill is not malicious, but it can read sensitive local OpenClaw and workspace files, including possible secrets, without a separate opt-in for that deeper scope.

Install only if you are comfortable with an agent auditing local OpenClaw configuration, cron prompts, skills, workspace files, and possible secrets. Prefer running the quick Phase 1 scan first, review the reported paths, and give explicit permission before any Phase 2 step opens files likely to contain credentials or customer data.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/audit.py:109
Finding

Broad Sensitive-File Reconnaissance Beyond the Minimum Audit Scope

Content
View full analysis
= 500: break files_scanned += 1 try: content = fp.read_text(errors="replace")[:16384] except OSError: continue for pattern, label in secret_patterns: if re.search(pattern, content): rel = str(fp.relative_to(oc_dir)) workspace_secrets.append((rel, label)) break # one finding per file ``` `scripts/audit.py:599-617` expands skill discovery to personal and system-level locations outside the selected OpenClaw dir ...[truncated 4913 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

md
| Module | Weight | What it catches |
|--------|--------|-----------------|
| Security | 30% | Inline secrets in env.vars, plaintext bot tokens, unprotected .env files |
| Cron | 25% | Error states, stale jobs, schedule conflicts, missing timezones |
| Config | 20% | Missing heartbeat, no fallbacks, no session maintenance, no compaction |
| Skills | 25% | Broken frontmatter, missing dependencies, structural quality scoring |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/remediation.md (reported line 62)May include surrounding context.

md
| Module | Weight | What it catches |
|--------|--------|-----------------|
| Security | 30% | Inline secrets in env.vars, plaintext bot tokens, unprotected .env files |
| Cron | 25% | Error states, stale jobs, schedule conflicts, missing timezones |
| Config | 20% | Missing heartbeat, no fallbacks, no session maintenance, no compaction |
| Skills | 25% | Broken frontmatter, missing dependencies, structural quality scoring |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/remediation.md (reported line 68)May include surrounding context.

md
| Module | Weight | What it catches |
|--------|--------|-----------------|
| Security | 30% | Inline secrets in env.vars, plaintext bot tokens, unprotected .env files |
| Cron | 25% | Error states, stale jobs, schedule conflicts, missing timezones |
| Config | 20% | Missing heartbeat, no fallbacks, no session maintenance, no compaction |
| Skills | 25% | Broken frontmatter, missing dependencies, structural quality scoring |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/remediation.md (reported line 70)May include surrounding context.

md
| Module | Weight | What it catches |
|--------|--------|-----------------|
| Security | 30% | Inline secrets in env.vars, plaintext bot tokens, unprotected .env files |
| Cron | 25% | Error states, stale jobs, schedule conflicts, missing timezones |
| Config | 20% | Missing heartbeat, no fallbacks, no session maintenance, no compaction |
| Skills | 25% | Broken frontmatter, missing dependencies, structural quality scoring |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 132)May include surrounding context.

python
| Module | Weight | What it catches |
|--------|--------|-----------------|
| Security | 30% | Inline secrets in env.vars, plaintext bot tokens, unprotected .env files |
| Cron | 25% | Error states, stale jobs, schedule conflicts, missing timezones |
| Config | 20% | Missing heartbeat, no fallbacks, no session maintenance, no compaction |
| Skills | 25% | Broken frontmatter, missing dependencies, structural quality scoring |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 146)May include surrounding context.

python
| Module | Weight | What it catches |
|--------|--------|-----------------|
| Security | 30% | Inline secrets in env.vars, plaintext bot tokens, unprotected .env files |
| Cron | 25% | Error states, stale jobs, schedule conflicts, missing timezones |
| Config | 20% | Missing heartbeat, no fallbacks, no session maintenance, no compaction |
| Skills | 25% | Broken frontmatter, missing dependencies, structural quality scoring |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md
- Check if any skill `scripts/` contain hardcoded credentials or API URLs with embedded tokens
- Check if `.env` files exist inside skill directories
- Look for credentials in cron job prompts (some prompts inline API keys instead of referencing env vars)
- Check if any workspace knowledge files contain customer data, passwords, or access tokens

## Output Format

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 133)May include surrounding context.

python
))

    # 5. .env files without .gitignore
    env_files = list(oc_dir.rglob(".env"))
    if env_files:
        gitignore = oc_dir / ".gitignore"
        protected = False

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 139)May include surrounding context.

python
))

    # 5. .env files without .gitignore
    env_files = list(oc_dir.rglob(".env"))
    if env_files:
        gitignore = oc_dir / ".gitignore"
        protected = False

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 167)May include surrounding context.

python
))

    # 5. .env files without .gitignore
    env_files = list(oc_dir.rglob(".env"))
    if env_files:
        gitignore = oc_dir / ".gitignore"
        protected = False

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 147)May include surrounding context.

python
findings.append(finding(
                "warning", "security",
                f"{len(env_files)} .env file(s) found without .gitignore protection",
                "Add '.env' to .gitignore"
            ))

    # 6. Secrets in workspace files (markdown, scripts, JSON, YAML)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The remediation guide prescribes a specific locale-based timezone value, Europe/Madrid, as the example fix for missing timezones. Because the document does not mention choosing a timezone appropriate to the user's region or deployment context, it can be read as steering users toward a specific locale without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The docstring at L013 describes the tool in a narrow way focused on JSON output and stdlib usage, but the implementation later inspects host binaries with shutil.which and traverses /usr/local/Cellar/node to discover bundled skills. That behavior is not merely omitted documentation about formatting; it expands the operational scope of what the script audits.

Content

No source excerpt is available for this finding.