Security audit

OpenClaw Refactoring

Security checks for vulnerabilities and agentic risk

Overview

This refactoring skill is not clearly malicious, but it can modify projects more broadly and less safely than it claims.

Review carefully before installing. Use only on version-controlled test projects, run with --dry-run first, avoid --no-backup, do not pass untrusted backup IDs to undo, and be aware that advertised refactorings and safety guarantees do not match the shipped implementation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

Location: scripts/suggest.py:16
Finding: Untrusted External Module Import Enables Arbitrary Code Execution
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/rename.py:258
Finding: Unvalidated Backup Identifier Allows Directory Traversal During Restore
Content: View full analysis
Dict[str, Any]: """Undo a refactoring operation""" if backup_id is None: # Find most recent backup if not self.backup_dir.exists(): return {'success': False, 'message': 'No backups found'} backups = sorted(self.backup_dir.iterdir(), key=lambda x: x.stat().st_mtime, reverse=True) if not backups: return {'success': False, 'message': 'No backups found'} backup_path = backups[0] else: backup_path = self.backup_dir / backup_id if not backup_path.exists(): return {'success': False, 'message': f'Backup {backup_id} not found'} # Restore files from backup restored = 0 for backup_file in backup_path.rglob('*'): if backup_file.is_file(): rel_path = backup_file.relative_to(backup_path) target_path = self.root / rel_path target_path.parent.mkdir(parents=True, exist_ok=True) shutil.copy2(backup_file, target_path) restored += 1 return { 'success': True, 'message': f'Restored {restored} files from backup {backup_path.name}' } ``` ### Technical Analysis The user-controlled `backup_id` is joined directly to `self.backup_dir` without validation or a containment check. A value containing traversal components can escape the backup directory. In addition, `pathlib` discards the preceding path when the second operand is absolute, allowing an absolute `backup_id` to select an arbitrary existing directory. The selected directory is then recursively enumerated. Every regular file beneath it is copied into the project root using its path relative to the attacker-selected directory. Existing project files at matching relative paths are ...[truncated 1594 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/rename.py:231
Finding: Incorrect AST Offsets Can Cause Destructive Source-Code Modification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:157
Finding: Documented Preview-by-Default Safety Control Is Not Implemented
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: If the underlying implementation performs rename operations via text replacement rather than AST-aware symbol refactoring, the claim of 'safe' refactoring is misleading and can cause unintended edits in comments, strings, or unrelated identifiers. In a code-modifying skill, overstated safety features materially raise the chance of integrity-impacting changes because users may trust it to make bulk edits automatically.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the underlying implementation performs rename operations via text replacement rather than AST-aware symbol refactoring, the claim of 'safe' refactoring is misleading and can cause unintended edits in comments, strings, or unrelated identifiers. In a code-modifying skill, overstated safety features materially raise the chance of integrity-impacting changes because users may trust it to make bulk edits automatically.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the underlying implementation performs rename operations via text replacement rather than AST-aware symbol refactoring, the claim of 'safe' refactoring is misleading and can cause unintended edits in comments, strings, or unrelated identifiers. In a code-modifying skill, overstated safety features materially raise the chance of integrity-impacting changes because users may trust it to make bulk edits automatically.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description and feature documentation switch to Chinese and present the usage instructions in that language without stating that another language is available. This creates a locale/language constraint in the skill's natural-language interface without user opt-in, which matches the policy-violation category.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The roadmap explicitly shows extract method, inline variable, move code, and refactoring suggestions as unchecked, which indicates they are not yet implemented. This directly conflicts with earlier sections that describe these operations as supported features with concrete usage examples, creating active intent/documentation divergence within the skill file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.