Security checks for vulnerabilities and agentic risk
Overview
This OpenClaw troubleshooting skill is mostly purpose-aligned, but it overreaches by using broad memory/profile access, external searches with raw diagnostics, and potentially modifying repair commands without clear consent gates.
Review before installing. Use this only in non-sensitive OpenClaw workspaces unless external search, memory writes, Canvas report persistence, and any `openclaw doctor --fix` or `sudo` command are explicitly reviewed and approved. Redact logs, tokens, hostnames, private paths, and project names before using its search or report features.
' for cause in diag_data['rootCause']['causes']])}
text
{diag_data['fixCommand']}
"""
```
The generated document is subsequently persisted:
```python
html_index_path = full_path / "index.html"
with open(html_index_path, "w", encoding="utf-8") as f:
f.write(html_content)
```
From `scripts/elis_helper.py`:
```python
html = f"""
Diagnostic Report
"""
```
### Technical Analysis
Both report generators interpolate error logs, root-cause text, cause lists, problem types, and repair commands directly into HTML. No HTML escaping, sanitization, or content-security policy is applied.
Error output is not inherently trusted. It may contain data controlled by a malicious executable, package, repository, filename, remote service, or user-provided test case. Injecting that output directly into a persistent HTML document allows markup and script elements to be interpreted by the browser.
Becau
...[truncated 1233 chars]
Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
str:
base_command = "openclaw doctor --fix"
if 'pty' in exec_output.lower():
return f"{base_command} --pty=true --yieldMs=15000"
elif 'permission' in exec_output.lower():
return f"sudo {base_command}"
elif 'timeout' in exec_output.lower():
return f"{base_command} --timeout=300"
return base_command
```
### Technical Analysis
The code infers that administrator privileges are required solely because an error line contains the substring `permission`. This does not establish which resource was denied, whether the operation should be permitted, or whether privilege elevation is appropriate.
Error output can also be attacker-controlled. A malicious tool can deliberately print the word `permission` to influence the recommendation engine. The resulting command combines `sudo` with a modifying `--fix` operation, substantially increasing potential impact.
The analyzer reports a fixed confidence score of `0.85` by default, which may make this weak heuristic appear more reliable than it is.
### Attack Path
1. A tested command, dependency, or malicious project emits an error
...[truncated 963 chars]
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
Category
YARA Match
Confidence
80% confidence
Finding
The tutorial promotes rendering generated HTML via canvas mechanisms and even suggests embedding content through a data:text/html;base64 URL. In an agent-skill context, treating LLM-derived analysis or error logs as HTML without strict sanitization can enable script injection, active content execution, or UI spoofing inside the canvas/report surface, especially since the examples also reference script injection patterns like
Content
Scanner excerpt · docs/tutorials/EXAMPLE_usage.md (reported line 64)May include surrounding context.
This markdown file contains core operational constraints in Chinese, and substantial workflow instructions later in the file also switch to Chinese. Because the skill does not offer the user a language/locale choice or explain that it is intended only for Chinese-speaking contexts, it risks forcing a language preference without user opt-in.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The main workflow heading and detailed procedural content are written in Chinese while other sections are in English. This mixed-language structure can effectively impose a language requirement on users and operators who did not opt into that locale, which matches the natural-language policy violation criteria.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The entire skill-facing document is written in Chinese and does not indicate that language selection is optional or limited to a justified region-specific audience. This can violate language/locale policy when users are not given an explicit choice or opt-in for the locale.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
This markdown file contains natural-language guidance that assumes Chinese context, such as the example preference "老爸"的偏好, rather than explicitly offering a language or locale choice. Under the policy, forcing or assuming a specific language/locale without user opt-in is a violation unless clearly justified as region-specific.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
Lines 28 and 35 contain Chinese-only instructions governing behavior, but the file does not say that the skill is Chinese-specific or that users may choose their language. This can create a language-policy issue because the skill's behavior and warnings are partially expressed in a specific language by default.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The module explicitly instructs a broad fallback search across general web/community sources and labels the results as lower-authority, but it does not require notifying the user that their problem description may be sent to external search providers. In an agent workflow, this creates a real privacy and trust risk because potentially sensitive user inputs could be transmitted to third-party services and mixed with less reliable content without explicit consent or warning.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The document switches from English to Chinese for the Step 3 section and related parameter descriptions, but does not indicate that the user opted into Chinese or that the skill is region-specific. This can violate language/locale policy by forcing or unexpectedly introducing a different language without user choice.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
This markdown file contains user-facing operational instructions partly in Chinese, which imposes a locale/language constraint without any stated opt-in or alternative. The policy requires flagging language or locale restrictions unless the skill explicitly offers choice or clearly justifies the constraint.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding
Lines describing the core approval and execution flow are presented in Chinese, including the user approval step, with no indication that users can choose their preferred language. This is a natural-language policy issue because it forces a specific language in a critical interaction path.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The module explicitly instructs the agent to persist problem descriptions, solutions, lessons learned, and session state to memory and files, but it provides no user notice, consent gate, minimization rule, or sensitivity filter. This creates a real privacy and retention risk because session-derived data may contain secrets, personal data, internal system details, or other sensitive content that will be stored beyond the current interaction.
Content
No source excerpt is available for this finding.
Ssd 3
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The module combines broad retention of session-derived facts and lessons with subsequent retrieval and reflection of history back to the user. That pattern materially increases the risk of storing sensitive natural-language content and later disclosing it out of context, especially because the stored fields are broad and the retrieval corpus is 'all'.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The skill directs a cross-session search over the entire memory corpus using the current problem summary, then encourages surfacing prior resolution details in the reply. Without privacy controls, access restrictions, or user warning, this can expose unrelated historical data and cause cross-session leakage of sensitive information into the current conversation.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding
The mixed Chinese and English instructions/output are not inherently dangerous on their own, but in a security-sensitive workflow they can prevent users from understanding that data may be searched, persisted, or used to suggest new tools. That loss of clarity undermines informed consent and reviewability, increasing the chance that users unknowingly approve or miss risky data-handling behavior.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The ELIS workflow sends exec-derived error content to external search and memory sources (tavily_search plus broad corpus recall) even though the stated feature is error summarization. Exec output often contains sensitive paths, hostnames, tokens, stack traces, or proprietary configuration details, so enriching it with external search increases the chance of unintended data disclosure beyond what is necessary for local diagnosis.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
This markdown specifies user-facing analysis fields and labels in Chinese, including '根因', '可能原因', '修复建议', and '风险等级', and later provides a Chinese analysis report template. Because the file does not offer user opt-in or an alternative locale, it effectively forces a specific language in violation of the language/locale policy.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The 'User-Friendly Analysis Output' section is entirely written as a Chinese-language report template intended for presentation to the user. There is no documented locale constraint, regional justification, or user choice, so this is a natural-language policy violation for forced language output.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
Lines L041-L047 describe interactive HTML diagnostic report generation as an implemented enhancement, yet lines L019-L020 and L104-L105 say the report generator tool still remains to be created. That documentation contradicts whether the capability actually exists in runnable form.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The rollback section includes destructive deletion commands and rollback operations without prominent safety checks, path verification guidance, or backup warnings. In a skill context, operators may copy-paste these commands directly, causing accidental deletion of files or rollback of the wrong workspace content, especially on Windows paths under a user profile.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
Lines L187-L190 and L228 present v5.0 core functionality as completed, including that the ELIS analysis framework is in place, while lines L019-L020, L103-L106, and L222 explicitly say the required tool files still need to be created and the status is pending. This is an active contradiction in the document's stated implementation status, not merely missing detail.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding
Planning to read USER.md and IDENTITY.md without any privacy boundaries or sensitive-data handling guidance creates a real risk of unnecessary collection, exposure, or propagation of personal or identity-related data. In an agent skill, such files may contain user preferences, profile data, or secrets that could be incorporated into prompts, logs, reports, or downstream systems.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
The document explicitly proposes using an LLM to automatically analyze exec output and error logs, but it provides no warning that command output may contain secrets, internal paths, tokens, credentials, customer data, or other sensitive operational details that could be sent to an AI service. In a troubleshooting skill, this is more dangerous because logs are routinely rich in sensitive data and the workflow encourages automatic transmission rather than a deliberate, reviewed step.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The rollback section includes destructive del commands that permanently remove files, but the document does not warn that these actions are irreversible or advise verifying paths and backups first. In this skill context, users are being guided through operational changes in a local workspace, so unsafe rollback instructions increase the chance of accidental data loss or deletion of the wrong files.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The report explicitly states the skill is 'ready for production' and 'can be immediately deployed' while also documenting unresolved integration gaps, simulated URL registration, and tooling that can generate and suggest system-affecting commands. In a security-sensitive agent skill context, this can encourage operators to deploy or trust partially validated automation without prominent warnings, increasing the chance of unsafe execution or overreliance on incomplete verification.
