Config-Sentinel

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.0.1

Overview

This skill is not malicious, but it needs review because its local OpenClaw config guardrail automatically makes Git commits and has rollback gaps that can defeat its recovery promise.

Review before installing if your OpenClaw config directory is a Git repository or may contain secrets. Use only with a trusted, clean config repo, understand that backups and Git history may preserve config contents, and do not rely on it as a complete automatic rollback system without testing the recovery path.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sentinel.sh:81

Finding

Git Snapshot Commits Unrelated Staged Content and Executes Repository Hooks

Content

View full analysis

/dev/null || true if git diff --cached --quiet; then log "No git snapshot created (no staged changes)" else git commit -m "config-sentinel: pre-change snapshot $ts" >/dev/null 2>&1 || true if git rev-parse HEAD >/dev/null 2>&1; then git rev-parse HEAD > "$LAST_GOOD_FILE" log "Git snapshot committed: $(cat "$LAST_GOOD_FILE")" fi fi ``` ### Technical Analysis The script stages the configuration file and then runs a normal `git commit`. A Git commit records the entire current index, not only the file just passed to `git add`. Consequently, files that were already staged before the skill ran will also be included in the snapshot commit. A normal `git commit` also invokes applicable repository hooks, including `pre-commit`, `prepare-commit-msg`, `commit-msg`, and `post-commit`. These hooks are executable code controlled by the local repository. If the configuration directory is an untrusted or compromised Git repository, invoking the snapshot operation can therefore execute attacker-controlled commands with the privileges of the user running the skill. The commands suppress errors through redirection and `|| true`. This can conceal staging or commit failures and may cause the script to treat an existing `HEAD` revision as the intended recovery point even if the new snapshot commit failed. ### Attack Path 1. An attacker or compromised local process places an executable malicious hook in the configuration repository, or causes sensitive/unrelated files to be staged in its Git index. 2. The user approves an OpenClaw configuration change. 3. The documented workflow invokes `scripts/sentinel.sh pre-change`. 4. The script stages the configuration file and calls `git commit`. 5. Git executes the repository hooks with ...[truncated 957 chars]

Remediation

View remediation

/dev/null || true` from security-critical Git operations. Check each command's exit status and abort with a clear error if staging or committing fails. 7. Write `LAST_GOOD_FILE` only after verifying that a new commit was successfully created and contains the expected configuration path. 8. Where practical, avoid operating on repositories whose ownership or trust status cannot be established. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sentinel.sh:226

Finding

Rollback Refuses to Restore a Deleted Configuration File

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs the agent to execute shell commands such as scripts/sentinel.sh pre-change, validate, and rollback, but it does not declare any permissions or allowed-tools scope. That creates an authorization gap: a platform or reviewer cannot tell from metadata that the skill requires shell execution against local files, increasing the chance of unintended command execution or over-broad tool access.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/sentinel.sh (reported line 37)May include surrounding context.

sh

init() {
  mkdir -p "$BACKUP_DIR"
  chmod 700 "$SENTINEL_DIR" "$BACKUP_DIR" 2>/dev/null || true
  touch "$LOG_FILE"
  chmod 600 "$LOG_FILE" 2>/dev/null || true
}

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/sentinel.sh (reported line 39)May include surrounding context.

sh

mkdir -p "$BACKUP_DIR"
  chmod 700 "$SENTINEL_DIR" "$BACKUP_DIR" 2>/dev/null || true
  touch "$LOG_FILE"
  chmod 600 "$LOG_FILE" 2>/dev/null || true
}

fail() {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/sentinel.sh (reported line 71)May include surrounding context.

sh

mkdir -p "$BACKUP_DIR"
  chmod 700 "$SENTINEL_DIR" "$BACKUP_DIR" 2>/dev/null || true
  touch "$LOG_FILE"
  chmod 600 "$LOG_FILE" 2>/dev/null || true
}

fail() {

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a guardrail that will 'rollback immediately when config health fails,' implying automatic restoration after a bad edit. In the code, validate() only logs and returns status 2 on issues, and neither validate nor health invokes rollback; rollback occurs only when the separate rollback action is explicitly called.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The description suggests broad protection against config regressions, but the implementation snapshots and restores only openclaw.json plus an optional git commit in the config directory. It does not preserve or restore related workspace files, bindings side effects outside the JSON, or broader agent state, so the implemented guardrail is narrower than advertised.

Content

No source excerpt is available for this finding.