Security audit

OpenClaw Problem Solver自动修复小龙虾

Security checks for vulnerabilities and agentic risk

Overview

This OpenClaw troubleshooting skill is mostly purpose-aligned, but it needs Review because it can persist as a background monitor, send diagnostics and credential-derived data externally, and perform automatic repairs with weak scoping controls.

Install only if you are comfortable with an OpenClaw-specific tool that reads local config, logs, sessions, and API-key settings. Keep the watchdog disabled unless you need continuous monitoring, avoid --install autostart until reviewed, do not use it with sensitive logs unless alerts are redacted, and prefer offline or explicit provider-bound credential checks.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/api_key_validator.py:39
Finding: DeepSeek Credentials Can Be Misclassified and Transmitted to OpenAI
Content: View full analysis
dict: if not key: return {"key_type": "Unknown"} cleaned = key.strip() for ktype, pattern in KEY_PATTERNS.items(): if re.match(pattern, cleaned): return {"key_type": ktype} return {"key_type": "Unknown"} def validate_openai_key(key: str, label: str = "OpenAI") -> dict: """Test OpenAI API key by listing models (cheapest endpoint).""" url = "https://api.openai.com/v1/models" try: req = urllib.request.Request(url, method="GET") req.add_header("Authorization", f"Bearer {key}") req.add_header("User-Agent", "OpenClaw-Autofix/6.0") start = time.time() with urllib.request.urlopen(req, timeout=REQUEST_TIMEOUT) as resp: ... ``` ### Technical Analysis OpenAI and DeepSeek credentials use overlapping `sk-` formats. Because Python dictionaries preserve insertion order and the OpenAI regular expression is evaluated before the DeepSeek expression, a DeepSeek key containing at least 30 characters after `sk-` is classified as an OpenAI key. The dispatch logic subsequently calls `validate_openai_key`, which places the complete credential in an HTTP Authorization header and sends it to `https://api.openai.com/v1/models`. The destination is unrelated to the service that issued the credential. This behavior is especially significant because `diagnosis_formatter.py` inv ...[truncated 1045 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/runtime_health_check.py:338
Finding: Credential Prefixes Are Sent to Arbitrary Provider Endpoints
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/watchdog_monitor.py:174
Finding: Gateway Bearer Token Can Be Transmitted Over Plaintext HTTP to a Non-Loopback Host
Content: View full analysis
Dict: global _config_cache, _config_mtime defaults = { "host": "127.0.0.1", "port": 18788, "token": None, "session_key": "agent:main:main" } try: mtime = OPENCLAW_CONFIG_PATH.stat().st_mtime if force or mtime > _config_mtime: with open(OPENCLAW_CONFIG_PATH, encoding="utf-8") as f: raw = json.load(f) g = raw.get("gateway", {}) host = g.get("bind", "127.0.0.1") defaults["host"] = "127.0.0.1" if host in ("loopback", "localhost") else host defaults["port"] = int(g.get("port", 18788)) defaults["token"] = g.get("auth", {}).get("token") ``` ```python def _check_http() -> Tuple[bool, str, Dict]: cfg = load_gateway_config() token = cfg.get("token") if not token: return _simulate() url = f"http://{cfg['host']}:{cfg['port']}/v1/models" try: req = urllib.request.Request( url, headers={"Authorization": f"Bearer {token}"} ) with urllib.request.urlopen(req, timeout=5) as resp: ... ``` ```python body = json.dumps({ "model": "openclaw", "messages": [{"role": "user", "content": f"[WD]\n\n{msg}"}], "max_tokens": 50 }).encode("utf-8") url = f"http://{cfg['host']}:{cfg['port']}/v1/chat/completions" req = urllib.request.Request(url, data=body, headers={ "Authorization": f"Bearer {token}", "Content-Type": "application/json", "X-OpenClaw-Session-Key": sk, "X-OpenClaw-Message-Channel": "webchat" }, method="POST") with urllib.request.urlopen(req, timeout=timeout) as resp: ... ``` ### Technical Analysis The watchdo ...[truncated 1473 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/health_dashboard.py:79
Finding: Unescaped Diagnostic Content Enables Stored HTML Injection in Canvas Dashboards
Content: View full analysis
str: """Generate a brutalist-minimalist HTML dashboard.""" if "error" in data: return f"
❌ Error
text
{data['error']}
" summary = data.get("summary", {}) overall = data.get("overall_severity", "🟢") items = data.get("items", []) errors = data.get("errors", []) ``` ```python for item in items: cat = item.get("category", "其他") if cat not in categories: categories[cat] = { "🔴": 0, "🟠": 0, "🟡": 0, "🟢": 0, "items": [] } categories[cat]["items"].append(item) ``` ```python items_html += f'''

{cat}

''' for item in cat_data["items"]: s = item.get("severity", "🟢") title = item.get("title", "") detail = item.get("detail", "") suggestion = item.get("suggestion", "") items_html += f'''

{title[:100]}
''' if detail and detail != title: d = detail[:150] + "..." if len(detail) > 150 else detail items_html += ( f'
{d}
' ) if suggestion: items_html += ( f'
' f'💡 {suggestion[:120]}
' ) ``` ```python errors_html = "" for err in errors: errors_html += ( f'
❌ {err}
' ) ``` ### Technical Analysis Diagnostic categories, titles, details, suggestions, and errors are inserted directly into HTML ...[truncated 1422 chars]
Remediation: View remediation
``` 8. Treat log and CLI output as hostile even when generated by a local process. ]]>

T02 · Agent Memory Poisoning

Error

Location: docs/MODULE_04_Finalization.md:8
Finding: Mandatory Persistence of User-Controlled Problem Content Creates Memory-Poisoning Risk
Content: View full analysis
Solution: [The definitive answer or successful MRE command]. 2. Learn Lesson (mem.learn(...)): (Core) Log actionable insights gained during the session. 3. Update State (~/proactivity/session-state.md): (Core) Update the active state file to reflect the current status of the task. ``` ```text Level 2 Proactive Check (Hot Start Query) Action: memory_search( query="[Current Problem Summary]", corpus="all", maxResults=3 ) ``` ### Technical Analysis The workflow directs the agent to store problem descriptions, solutions, and lessons as permanent facts. Those fields may contain attacker-controlled text, copied logs, commands, or instruction-like statements. No requirement is specified for user consent, provenance tagging, instruction/data separation, secret removal beyond the general privacy statement, trust scoring, project scoping, or expiry. The same module then directs future sessions to retrieve related memory from the full corpus. Consequently, attacker-authored instructions can be persisted as apparently authoritative lessons or facts and later reintroduced into an unrelated agent session. ### Attack Path 1. An attacker submits a problem description or log containing an instruction disguised as a diagnostic fact or lesson. 2. The Skill resolves or finalizes the interaction. 3. The mandatory finalization workflow stores the problem/solution pa ...[truncated 811 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/requirements.txt:1
Finding: Open-Ended Dependency Versions Permit Unreviewed Future Package Releases
Content: View full analysis
=310 psutil>=5.9.0 ``` The installation guide instructs users to install these ranges directly: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis The `>=` constraints allow any future version of `pywin32` or `psutil` to satisfy installation. No upper bounds, exact reviewed versions, package hashes, lock file, or trusted-index constraints are provided. Python package installation may run package build logic and installs native or privileged system-integration components. `pywin32` has access to Windows APIs, while `psutil` performs process and system inspection. A compromised future release or compromised package-distribution account would therefore be accepted without changes to this project. This finding does not establish that the named packages are currently malicious. The vulnerability is the absence of reproducible dependency controls. ### Attack Path 1. A future package release is compromised, malicious, or incompatible. 2. The release version satisfies the open-ended `>=` requirement. 3. A user follows the installation guide and runs `pip install -r scripts/requirements.txt`. 4. Pip downloads the newly published release. 5. Package build or installation code executes in the user's environment. 6. The installed package is imported by the watchdog or diagnostic scripts. ### Impact Assessment The package receives the privileges of the Python installation process and subsequent Skill execution. Depending on how installation is performed, this can include access to user files, OpenClaw configuration and credentials, process information, network access, and Windows system APIs. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (126)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: README 明确说明 v6.1 会把“完整的堆栈跟踪”和“详细诊断上下文”发送到飞书等外部消息渠道，但没有提示其中可能包含路径、主机信息、配置细节、令牌片段或其他敏感诊断数据。这会把本地故障信息外发到第三方平台，扩大敏感信息暴露面。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: This mismatch specifically hides materially security-relevant behaviors: autostart registry persistence, external notifications, process termination, and simulated/conditional monitoring behavior. When a troubleshooting skill omits or downplays persistence and outbound communications, users may authorize it under false assumptions, enabling stealthier long-lived access or data leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This mismatch specifically hides materially security-relevant behaviors: autostart registry persistence, external notifications, process termination, and simulated/conditional monitoring behavior. When a troubleshooting skill omits or downplays persistence and outbound communications, users may authorize it under false assumptions, enabling stealthier long-lived access or data leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This mismatch specifically hides materially security-relevant behaviors: autostart registry persistence, external notifications, process termination, and simulated/conditional monitoring behavior. When a troubleshooting skill omits or downplays persistence and outbound communications, users may authorize it under false assumptions, enabling stealthier long-lived access or data leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: This mismatch specifically hides materially security-relevant behaviors: autostart registry persistence, external notifications, process termination, and simulated/conditional monitoring behavior. When a troubleshooting skill omits or downplays persistence and outbound communications, users may authorize it under false assumptions, enabling stealthier long-lived access or data leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This mismatch specifically hides materially security-relevant behaviors: autostart registry persistence, external notifications, process termination, and simulated/conditional monitoring behavior. When a troubleshooting skill omits or downplays persistence and outbound communications, users may authorize it under false assumptions, enabling stealthier long-lived access or data leakage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: This mismatch specifically hides materially security-relevant behaviors: autostart registry persistence, external notifications, process termination, and simulated/conditional monitoring behavior. When a troubleshooting skill omits or downplays persistence and outbound communications, users may authorize it under false assumptions, enabling stealthier long-lived access or data leakage.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill presents itself as a diagnostic helper but also defines a persistent background watchdog that runs independently, alerts externally, and can trigger repairs. Persistent autonomous behavior significantly raises risk because it can continue executing beyond the original user request, monitor system state continuously, and create an ongoing channel for actions or data transmission.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Registering under HKCU\Run establishes user-level persistence on login, which is a classic persistence mechanism and is not necessary for most ad hoc troubleshooting tasks. In the context of an agent skill, this is dangerous because it allows the skill's code to keep running automatically after the original session ends, expanding exposure and enabling long-term unintended behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation authorizes autonomous repair actions without user confirmation for some conditions, which conflicts with the claimed diagnostic workflow and weakens change-control safeguards. Even 'low-risk' auto-execution can modify environment paths, service state, or configs incorrectly, causing damage, masking root causes, or creating a pathway for unintended command execution in response to manipulated health signals.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.
md
- **[watchdog_monitor.py](./scripts/watchdog_monitor.py)**: Gateway Watchdog daemon — background health monitoring + dual-channel alerting.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · docs/reports/CHANGES_v6.1.md (reported line 45)May include surrounding context.
md
| 变更 | 说明 | |------|------| | `run_cmd()` 改用 `Popen` + `taskkill` | 从 `subprocess.run(shell=True)` 迁移到安全的进程树终止模式 | | `check_disk_usage()` 跳过 `archive/sessions/node_modules` | os.walk 加速，避免扫大目录 | | `check_model_connectivity()` 限 3 个 provider + 4s 超时 | 避免遍历所有端点累积超时 | | Provider 连接增加 `Connection: close` 头 | 防止 keep-alive 挂起 |

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · docs/tutorials/EXAMPLE_usage.md (reported line 64)May include surrounding context.
md
│ ├─────────────────────────────────────────┤ │ 📋 问题概览 │ │ ────────────────────────────────────────│ │ Problem Type: exec_timeout │ │ Affected Tools: browser, exec │ ├─────────────────────────────────────────┤ │ 🔬 AI 根因分析 │ │ ────────────────────────────────────────│ │ 核心问题：exec 命令未指定 pty=true │ │ │ │ 可能原因： │ │ • 当前会话配置中缺少 pty 参数 │ │ • 目标命令�

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The example shows sending raw exec_output to an LLM for analysis without any privacy boundary, sanitization, or warning. Execution output often contains secrets, file paths, tokens, internal hostnames, stack traces, or customer data; forwarding it to a model service can cause unintended disclosure beyond the local runtime.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/api_key_validator.py (reported line 423)May include surrounding context.
python
# Fallback — try tasklist try: import subprocess r = subprocess.run( 'tasklist /FI "IMAGENAME eq node.exe" /FO CSV /NH', capture_output=True, text=True, timeout=5, shell=True )

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: Using shell=True for a tool invocation creates parameter-abuse risk because execution semantics depend on the shell rather than only the provided argument vector. On Windows this can enable command hijacking, altered resolution, or unexpected interpretation of executable paths and arguments, especially where the target command resides in a user-writable context. Within an autonomous repair component, such misuse is particularly dangerous because checks may be run routinely and without close operator review.
Content: Scanner excerpt · scripts/auto_repair.py (reported line 79)May include surrounding context.
python
def _gateway_status() -> dict: """快速获取 Gateway 状态。""" try: r = subprocess.run( [_OPENCLAW_CMD, "gateway", "status", "--json"], capture_output=True, text=True, timeout=12, shell=True, )

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The dangerous aspect here is not just subprocess use but the specific parameter combination: a structured argument list passed with shell=True. In an agent automation skill, that broadens the trust boundary to the shell and executable lookup rules, making it easier for an attacker to steer execution toward a malicious openclaw binary or abuse shell behavior.
Content: Scanner excerpt · scripts/diagnosis_formatter.py (reported line 189)May include surrounding context.
python
"""Fallback when openclaw doctor hangs: use gateway status instead.""" items = [] try: r = subprocess.run( ["openclaw", "gateway", "status", "--json"], capture_output=True, text=True, timeout=15, shell=True, )

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: This is a true tool-parameter abuse issue because the helper is a generic command runner and uses shell=True for commands executed by an autofix/diagnostic workflow. Even though the current call site uses a mostly fixed command, the reusable wrapper invites unsafe future use and can permit shell interpretation, turning malformed or attacker-influenced arguments into arbitrary command execution.
Content: Scanner excerpt · scripts/runtime_health_check.py (reported line 62)May include surrounding context.
python
import subprocess as _sp proc = None try: proc = _sp.Popen( cmd, stdout=_sp.PIPE, stderr=_sp.PIPE,

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The autostart installation path modifies the Windows registry to persist execution, and the action can be triggered via command-line flag without interactive confirmation. Registry persistence is highly sensitive because it changes system behavior beyond the current session and can be abused to maintain long-term execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger phrase 'auto repair' is very broad and could be activated by ordinary user requests that are not clearly intended to invoke this skill. In an agentic environment, ambiguous activation increases the chance of unintended execution of diagnostic or repair workflows, which may perform impactful system actions without sufficiently explicit user consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The feature list advertises auto-repair, task killing, session archiving, stale process cleanup, and HKCU\Run persistence, but does not prominently warn users that these are destructive or persistence-related behaviors. This omission can mislead users into invoking the skill without informed consent, increasing the chance of unexpected system modification or data loss.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are generic natural-language requests like 'check what's wrong with Gateway' and 'auto repair', which can easily overlap with ordinary user intent and cause the skill to activate in situations the user did not explicitly mean to invoke this package. In this skill's context, unintended activation is more dangerous because the documented behavior includes process termination, file archiving, automatic repair actions, and optional persistence mechanisms.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Sending detailed stack traces and full diagnostic context through Feishu can expose secrets, filesystem paths, environment-derived values, tokens, user content, or internal runtime state to an external messaging channel. In a diagnostic skill, this context often contains precisely the sensitive material attackers or unauthorized recipients would want, so the surrounding skill purpose makes the disclosure risk more acute, not less.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: 文档在 Watchdog 功能中描述了自动修复、残留进程清理、注册开机自启、发送通知等会影响系统与外部通信的行为，但未在相邻位置明确警告用户这些副作用。用户可能在未充分理解影响的情况下启用后台守护或安装自启动，造成意外进程终止、文件归档或对外消息发送。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: README 建议的触发短语如“check what's wrong with Gateway”“auto repair”非常通用，容易与普通对话或运维讨论重叠。在会执行诊断、修复、重启、归档等动作的技能上下文中，这种宽泛触发会增加误调用风险，导致非预期的系统变更。
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

❌ Error

T02 · Agent Memory Poisoning

T08 · Insecure Dependencies

SkillSpector

Missing User Warnings

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Description-Behavior Mismatch

Context-Inappropriate Capability

Context-Inappropriate Capability

Ae1

Tool Parameter Abuse

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

Missing User Warnings

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Missing User Warnings

Vague Triggers

Missing User Warnings

Vague Triggers

Ssd 3

Missing User Warnings

Vague Triggers