OpenClaw Problem Solver自动修复小龙虾

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:53 AM UTC
• Version: 6.1.0

Overview

This OpenClaw troubleshooting skill is mostly purpose-aligned, but it needs Review because it can persist as a background monitor, send diagnostics and credential-derived data externally, and perform automatic repairs with weak scoping controls.

Install only if you are comfortable with an OpenClaw-specific tool that reads local config, logs, sessions, and API-key settings. Keep the watchdog disabled unless you need continuous monitoring, avoid --install autostart until reviewed, do not use it with sensitive logs unless alerts are redacted, and prefer offline or explicit provider-bound credential checks.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/api_key_validator.py:39
• Finding: DeepSeek Credentials Can Be Misclassified and Transmitted to OpenAI<![CDATA[ ## Vulnerability Details **File Location**: `scripts/api_key_validator.py`, lines 39-47, 58-61, and 92-99 **Vulnerability Type**: Credential disclosure caused by ambiguous provider detection **Risk Level**: Critical ### Vulnerable Code ```python KEY_PATTERNS = { "OpenAI": r"^sk-(proj-)?[A-Za-z0-9_-]{30,}$", "Tavily": r"^tvly-[A-Za-z0-9-]{20,}$", "Notion": r"^ntn_[A-Za-z0-9]{20,}$", "GitHub": r"^gh[pousr]_[A-Za-z0-9]{20,}$", "DeepSeek": r"^sk-[A-Za-z0-9_-]{20,}$", "Feishu": r"^[A-Za-z0-9]{24,}$", "Generic": r"^[A-Za-z0-9_-]{16,}$", } def detect_key_type(key: str) -> dict: if not key: return {"key_type": "Unknown"} cleaned = key.strip() for ktype, pattern in KEY_PATTERNS.items(): if re.match(pattern, cleaned): return {"key_type": ktype} return {"key_type": "Unknown"} def validate_openai_key(key: str, label: str = "OpenAI") -> dict: """Test OpenAI API key by listing models (cheapest endpoint).""" url = "https://api.openai.com/v1/models" try: req = urllib.request.Request(url, method="GET") req.add_header("Authorization", f"Bearer {key}") req.add_header("User-Agent", "OpenClaw-Autofix/6.0") start = time.time() with urllib.request.urlopen(req, timeout=REQUEST_TIMEOUT) as resp: ... ``` ### Technical Analysis OpenAI and DeepSeek credentials use overlapping `sk-` formats. Because Python dictionaries preserve insertion order and the OpenAI regular expression is evaluated before the DeepSeek expression, a DeepSeek key containing at least 30 characters after `sk-` is classified as an OpenAI key. The dispatch logic subsequently calls `validate_openai_key`, which places the complete credential in an HTTP Authorization header and sends it to `https://api.openai.com/v1/models`. The destination is unrelated to the service that issued the credential. This behavior is especially significant because `diagnosis_formatter.py` inv ...[truncated 1045 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Determine the provider from the configuration structure, such as `providers.deepseek.apiKey`, rather than from an overlapping token prefix. 2. Replace first-match regular-expression classification with an explicit provider-to-credential mapping. 3. Treat ambiguous `sk-` credentials as unknown and skip online validation. 4. Require explicit user consent before sending any credential to a remote provider. 5. Display the exact destination hostname before validation without displaying the credential. 6. Add tests proving that DeepSeek credentials can never reach an OpenAI endpoint. 7. Make offline format validation the default and expose network validation through a separate opt-in flag such as `--online`. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/runtime_health_check.py:338
• Finding: Credential Prefixes Are Sent to Arbitrary Provider Endpoints<![CDATA[ ## Vulnerability Details **File Location**: `scripts/runtime_health_check.py`, lines 338-359 **Vulnerability Type**: Sensitive-data disclosure and unvalidated outbound request **Risk Level**: High ### Vulnerable Code ```python for name, p_cfg in testable[:MAX_PROVIDERS_TO_TEST]: base_url = p_cfg.get("baseUrl", "") or p_cfg.get("baseURL", "") or "" api_key = p_cfg.get("apiKey", "") or p_cfg.get("key", "") or "" # Strip trailing slash and standardize base_url = base_url.rstrip("/") # Determine which endpoint to hit if "/v1/" not in base_url: test_url = f"{base_url}/v1/models" else: test_url = f"{base_url}/models" if "models" not in base_url else base_url try: req = urllib.request.Request(test_url, method="GET") if api_key: req.add_header("Authorization", f"Bearer {api_key[:8]}...") req.add_header("User-Agent", "OpenClaw-Autofix/6.0") req.add_header("Connection", "close") start = time.time() with urllib.request.urlopen(req, timeout=4) as resp: ... ``` ### Technical Analysis The health checker accepts `baseUrl` directly from the OpenClaw configuration and performs a network request without restricting the URL scheme, hostname, IP range, or destination ownership. When a provider has an API key, the request includes the first eight characters followed by an ellipsis in the Authorization header. Although this is not the complete credential, token prefixes can identify accounts, token families, deployment environments, or provider-specific values. Sending any credential-derived material is unnecessary for a basic reachability test. The unrestricted destination also creates a limited server-side request forgery primitive from the user's machine. ### Attack Path 1. An attacker, compromised configuration import, or malicious project changes a provider `baseUrl` to an attacker-controlled HTTP endpoint. 2. The victim runs the documented ...[truncated 842 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not include any API-key material in a connectivity-only request. 2. Validate URLs using a strict parser and allow only `https`. 3. Require explicit approval before contacting a custom provider hostname. 4. Block loopback, private, link-local, multicast, and metadata-service addresses unless the user explicitly enables local-provider testing. 5. Resolve the hostname and revalidate all resolved addresses to mitigate DNS rebinding. 6. Separate unauthenticated network reachability tests from authenticated provider validation. 7. If authenticated validation is required, send the complete credential only to a provider destination explicitly bound to that credential and approved by the user. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/watchdog_monitor.py:174
• Finding: Gateway Bearer Token Can Be Transmitted Over Plaintext HTTP to a Non-Loopback Host<![CDATA[ ## Vulnerability Details **File Location**: `scripts/watchdog_monitor.py`, lines 174-185, 237-243, and 303-318 **Vulnerability Type**: Plaintext transmission of a sensitive authentication token **Risk Level**: Critical ### Vulnerable Code ```python def load_gateway_config(force: bool = False) -> Dict: global _config_cache, _config_mtime defaults = { "host": "127.0.0.1", "port": 18788, "token": None, "session_key": "agent:main:main" } try: mtime = OPENCLAW_CONFIG_PATH.stat().st_mtime if force or mtime > _config_mtime: with open(OPENCLAW_CONFIG_PATH, encoding="utf-8") as f: raw = json.load(f) g = raw.get("gateway", {}) host = g.get("bind", "127.0.0.1") defaults["host"] = "127.0.0.1" if host in ("loopback", "localhost") else host defaults["port"] = int(g.get("port", 18788)) defaults["token"] = g.get("auth", {}).get("token") ``` ```python def _check_http() -> Tuple[bool, str, Dict]: cfg = load_gateway_config() token = cfg.get("token") if not token: return _simulate() url = f"http://{cfg['host']}:{cfg['port']}/v1/models" try: req = urllib.request.Request( url, headers={"Authorization": f"Bearer {token}"} ) with urllib.request.urlopen(req, timeout=5) as resp: ... ``` ```python body = json.dumps({ "model": "openclaw", "messages": [{"role": "user", "content": f"[WD]\n\n{msg}"}], "max_tokens": 50 }).encode("utf-8") url = f"http://{cfg['host']}:{cfg['port']}/v1/chat/completions" req = urllib.request.Request(url, data=body, headers={ "Authorization": f"Bearer {token}", "Content-Type": "application/json", "X-OpenClaw-Session-Key": sk, "X-OpenClaw-Message-Channel": "webchat" }, method="POST") with urllib.request.urlopen(req, timeout=timeout) as resp: ... ``` ### Technical Analysis The watchdo ...[truncated 1473 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce loopback-only communication whenever bearer tokens are used over HTTP. 2. Reject wildcard, LAN, or remote hosts unless an explicit secure remote mode is enabled. 3. Require HTTPS with normal certificate and hostname validation for all non-loopback destinations. 4. Store an explicit Gateway URL rather than inferring the destination from a bind setting. 5. Avoid transmitting session keys unless strictly required. 6. Warn the user and refuse startup when a token-bearing remote connection is configured without TLS. 7. Support token rotation and advise immediate rotation after any suspected plaintext exposure. 8. Add tests for wildcard binds, IPv6 loopback, private addresses, and remote hostnames. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/health_dashboard.py:79
• Finding: Unescaped Diagnostic Content Enables Stored HTML Injection in Canvas Dashboards<![CDATA[ ## Vulnerability Details **File Location**: `scripts/health_dashboard.py`, lines 79-82 and 94-196 **Vulnerability Type**: Stored HTML and script injection **Risk Level**: High ### Vulnerable Code ```python def generate_html(data: dict) -> str: """Generate a brutalist-minimalist HTML dashboard.""" if "error" in data: return f"<h1>❌ Error</h1><pre>{data['error']}</pre>" summary = data.get("summary", {}) overall = data.get("overall_severity", "🟢") items = data.get("items", []) errors = data.get("errors", []) ``` ```python for item in items: cat = item.get("category", "其他") if cat not in categories: categories[cat] = { "🔴": 0, "🟠": 0, "🟡": 0, "🟢": 0, "items": [] } categories[cat]["items"].append(item) ``` ```python items_html += f''' <div style="margin:16px 0;background:white;border-left:4px solid {cat_color};"> <div style="padding:12px 16px;"> <span>{cat}</span> </div> <div style="padding:4px 0;">''' for item in cat_data["items"]: s = item.get("severity", "🟢") title = item.get("title", "") detail = item.get("detail", "") suggestion = item.get("suggestion", "") items_html += f''' <div style="padding:10px 16px;"> <div style="flex:1;min-width:0;"> <div style="font-size:14px;font-weight:500;">{title[:100]}</div>''' if detail and detail != title: d = detail[:150] + "..." if len(detail) > 150 else detail items_html += ( f'<div style="font-size:12px;color:#888;">{d}</div>' ) if suggestion: items_html += ( f'<div style="font-size:12px;color:{color};">' f'💡 {suggestion[:120]}</div>' ) ``` ```python errors_html = "" for err in errors: errors_html += ( f'<div style="padding:8px;color:#d32f2f;">❌ {err}</div>' ) ``` ### Technical Analysis Diagnostic categories, titles, details, suggestions, and errors are inserted directly into HTML ...[truncated 1422 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Apply `html.escape(value, quote=True)` to every untrusted value before interpolation. 2. Escape categories, titles, details, suggestions, errors, timestamps, versions, and baseline fields. 3. Prefer a template engine with automatic HTML escaping. 4. When using JavaScript, create text nodes or assign `textContent`; never assign untrusted data through `innerHTML`. 5. Add a restrictive Content Security Policy that disallows inline scripts and event handlers. 6. Serve generated reports from a sandboxed, opaque origin without access to privileged application APIs. 7. Add regression tests using payloads in every diagnostic field, including: ```html <img src=x onerror=alert(1)> ``` 8. Treat log and CLI output as hostile even when generated by a local process. ]]>

T02 · Agent Memory Poisoning

Error

• Location: docs/MODULE_04_Finalization.md:8
• Finding: Mandatory Persistence of User-Controlled Problem Content Creates Memory-Poisoning Risk<![CDATA[ ## Vulnerability Details **File Location**: `docs/MODULE_04_Finalization.md`, lines 8-29 **Vulnerability Type**: Persistent storage and later retrieval of untrusted instructions **Risk Level**: High ### Vulnerable Instructions ```text Goal: To ensure continuity across sessions by persisting all relevant information derived from the problem-solving process into OpenClaw's memory structure, while proactively suggesting next steps and new tools. 1. Remember Fact (mem.remember(...)): (Core) Store the core problem/solution pair as a permanent fact. Data Stored: Fact: [Problem Description] -> Solution: [The definitive answer or successful MRE command]. 2. Learn Lesson (mem.learn(...)): (Core) Log actionable insights gained during the session. 3. Update State (~/proactivity/session-state.md): (Core) Update the active state file to reflect the current status of the task. ``` ```text Level 2 Proactive Check (Hot Start Query) Action: memory_search( query="[Current Problem Summary]", corpus="all", maxResults=3 ) ``` ### Technical Analysis The workflow directs the agent to store problem descriptions, solutions, and lessons as permanent facts. Those fields may contain attacker-controlled text, copied logs, commands, or instruction-like statements. No requirement is specified for user consent, provenance tagging, instruction/data separation, secret removal beyond the general privacy statement, trust scoring, project scoping, or expiry. The same module then directs future sessions to retrieve related memory from the full corpus. Consequently, attacker-authored instructions can be persisted as apparently authoritative lessons or facts and later reintroduced into an unrelated agent session. ### Attack Path 1. An attacker submits a problem description or log containing an instruction disguised as a diagnostic fact or lesson. 2. The Skill resolves or finalizes the interaction. 3. The mandatory finalization workflow stores the problem/solution pa ...[truncated 811 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make every long-term memory write opt-in and show the exact sanitized content before saving it. 2. Store structured, minimal summaries rather than raw user text, logs, or command output. 3. Remove secrets, identifiers, URLs, and instruction-like language before persistence. 4. Mark memory with provenance, creation time, project scope, author, confidence, and trust level. 5. Treat all retrieved memory as untrusted reference data that cannot override current instructions or safety policy. 6. Search only the current project or user scope by default rather than `corpus="all"`. 7. Add expiration, review, correction, and deletion controls. 8. Never automatically convert user-authored behavioral instructions into reusable lessons. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1
• Finding: Open-Ended Dependency Versions Permit Unreviewed Future Package Releases<![CDATA[ ## Vulnerability Details **File Location**: `scripts/requirements.txt`, lines 1-2 **Vulnerability Type**: Non-reproducible and insufficiently constrained dependency installation **Risk Level**: Medium ### Vulnerable Configuration ```text pywin32>=310 psutil>=5.9.0 ``` The installation guide instructs users to install these ranges directly: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis The `>=` constraints allow any future version of `pywin32` or `psutil` to satisfy installation. No upper bounds, exact reviewed versions, package hashes, lock file, or trusted-index constraints are provided. Python package installation may run package build logic and installs native or privileged system-integration components. `pywin32` has access to Windows APIs, while `psutil` performs process and system inspection. A compromised future release or compromised package-distribution account would therefore be accepted without changes to this project. This finding does not establish that the named packages are currently malicious. The vulnerability is the absence of reproducible dependency controls. ### Attack Path 1. A future package release is compromised, malicious, or incompatible. 2. The release version satisfies the open-ended `>=` requirement. 3. A user follows the installation guide and runs `pip install -r scripts/requirements.txt`. 4. Pip downloads the newly published release. 5. Package build or installation code executes in the user's environment. 6. The installed package is imported by the watchdog or diagnostic scripts. ### Impact Assessment The package receives the privileges of the Python installation process and subsequent Skill execution. Depending on how installation is performed, this can include access to user files, OpenClaw configuration and credentials, process information, network access, and Windows system APIs. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin dependencies to exact versions that have been reviewed and tested. 2. Generate hashes for every permitted wheel and install with: ```bash pip install --require-hashes -r requirements.txt ``` 3. Maintain a lock file per supported Python and operating-system version. 4. Use a controlled package index or explicitly specify the trusted package source. 5. Review release notes and artifacts before dependency upgrades. 6. Run dependency and software-composition analysis in continuous integration. 7. Prefer binary wheels from verified publishers and avoid unexpected source builds. 8. Document a repeatable process for updating and re-auditing dependency pins. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (126)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: README 明确说明 v6.1 会把“完整的堆栈跟踪”和“详细诊断上下文”发送到飞书等外部消息渠道，但没有提示其中可能包含路径、主机信息、配置细节、令牌片段或其他敏感诊断数据。这会把本地故障信息外发到第三方平台，扩大敏感信息暴露面。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: This mismatch specifically hides materially security-relevant behaviors: autostart registry persistence, external notifications, process termination, and simulated/conditional monitoring behavior. When a troubleshooting skill omits or downplays persistence and outbound communications, users may authorize it under false assumptions, enabling stealthier long-lived access or data leakage.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This mismatch specifically hides materially security-relevant behaviors: autostart registry persistence, external notifications, process termination, and simulated/conditional monitoring behavior. When a troubleshooting skill omits or downplays persistence and outbound communications, users may authorize it under false assumptions, enabling stealthier long-lived access or data leakage.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This mismatch specifically hides materially security-relevant behaviors: autostart registry persistence, external notifications, process termination, and simulated/conditional monitoring behavior. When a troubleshooting skill omits or downplays persistence and outbound communications, users may authorize it under false assumptions, enabling stealthier long-lived access or data leakage.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: This mismatch specifically hides materially security-relevant behaviors: autostart registry persistence, external notifications, process termination, and simulated/conditional monitoring behavior. When a troubleshooting skill omits or downplays persistence and outbound communications, users may authorize it under false assumptions, enabling stealthier long-lived access or data leakage.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: This mismatch specifically hides materially security-relevant behaviors: autostart registry persistence, external notifications, process termination, and simulated/conditional monitoring behavior. When a troubleshooting skill omits or downplays persistence and outbound communications, users may authorize it under false assumptions, enabling stealthier long-lived access or data leakage.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: This mismatch specifically hides materially security-relevant behaviors: autostart registry persistence, external notifications, process termination, and simulated/conditional monitoring behavior. When a troubleshooting skill omits or downplays persistence and outbound communications, users may authorize it under false assumptions, enabling stealthier long-lived access or data leakage.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill presents itself as a diagnostic helper but also defines a persistent background watchdog that runs independently, alerts externally, and can trigger repairs. Persistent autonomous behavior significantly raises risk because it can continue executing beyond the original user request, monitor system state continuously, and create an ongoing channel for actions or data transmission.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Registering under HKCU\Run establishes user-level persistence on login, which is a classic persistence mechanism and is not necessary for most ad hoc troubleshooting tasks. In the context of an agent skill, this is dangerous because it allows the skill's code to keep running automatically after the original session ends, expanding exposure and enabling long-term unintended behavior.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: The documentation authorizes autonomous repair actions without user confirmation for some conditions, which conflicts with the claimed diagnostic workflow and weakens change-control safeguards. Even 'low-risk' auto-execution can modify environment paths, service state, or configs incorrectly, causing damage, masking root causes, or creating a pathway for unintended command execution in response to manipulated health signals.

Ae1

High

• Category: analysis-evasion

Content

- **[watchdog_monitor.py](./scripts/watchdog_monitor.py)**: Gateway Watchdog daemon — background health monitoring + dual-channel alerting.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| 变更 | 说明 |
|------|------|
| `run_cmd()` 改用 `Popen` + `taskkill` | 从 `subprocess.run(shell=True)` 迁移到安全的进程树终止模式 |
| `check_disk_usage()` 跳过 `archive/sessions/node_modules` | os.walk 加速，避免扫大目录 |
| `check_model_connectivity()` 限 3 个 provider + 4s 超时 | 避免遍历所有端点累积超时 |
| Provider 连接增加 `Connection: close` 头 | 防止 keep-alive 挂起 |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

│
├─────────────────────────────────────────┤
│ 📋 问题概览                             │
│ ────────────────────────────────────────│
│ Problem Type: exec_timeout              │
│ Affected Tools: browser, exec           │
├─────────────────────────────────────────┤
│ 🔬 AI 根因分析                           │
│ ────────────────────────────────────────│
│ 核心问题：exec 命令未指定 pty=true       │
│                                         │
│ 可能原因：                               │
│ • 当前会话配置中缺少 pty 参数            │
│ • 目标命令�

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The example shows sending raw `exec_output` to an LLM for analysis without any privacy boundary, sanitization, or warning. Execution output often contains secrets, file paths, tokens, internal hostnames, stack traces, or customer data; forwarding it to a model service can cause unintended disclosure beyond the local runtime.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Fallback — try tasklist
        try:
            import subprocess
            r = subprocess.run(
                'tasklist /FI "IMAGENAME eq node.exe" /FO CSV /NH',
                capture_output=True, text=True, timeout=5, shell=True
            )

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def _gateway_status() -> dict:
    """快速获取 Gateway 状态。"""
    try:
        r = subprocess.run(
            [_OPENCLAW_CMD, "gateway", "status", "--json"],
            capture_output=True, text=True, timeout=12, shell=True,
        )

• Confidence: 96% confidence
• Finding: Using shell=True for a tool invocation creates parameter-abuse risk because execution semantics depend on the shell rather than only the provided argument vector. On Windows this can enable command hijacking, altered resolution, or unexpected interpretation of executable paths and arguments, especially where the target command resides in a user-writable context. Within an autonomous repair component, such misuse is particularly dangerous because checks may be run routinely and without close operator review.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

"""Fallback when openclaw doctor hangs: use gateway status instead."""
    items = []
    try:
        r = subprocess.run(
            ["openclaw", "gateway", "status", "--json"],
            capture_output=True, text=True, timeout=15, shell=True,
        )

• Confidence: 99% confidence
• Finding: The dangerous aspect here is not just subprocess use but the specific parameter combination: a structured argument list passed with `shell=True`. In an agent automation skill, that broadens the trust boundary to the shell and executable lookup rules, making it easier for an attacker to steer execution toward a malicious `openclaw` binary or abuse shell behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

import subprocess as _sp
    proc = None
    try:
        proc = _sp.Popen(
            cmd,
            stdout=_sp.PIPE,
            stderr=_sp.PIPE,

• Confidence: 99% confidence
• Finding: This is a true tool-parameter abuse issue because the helper is a generic command runner and uses shell=True for commands executed by an autofix/diagnostic workflow. Even though the current call site uses a mostly fixed command, the reusable wrapper invites unsafe future use and can permit shell interpretation, turning malformed or attacker-influenced arguments into arbitrary command execution.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The autostart installation path modifies the Windows registry to persist execution, and the action can be triggered via command-line flag without interactive confirmation. Registry persistence is highly sensitive because it changes system behavior beyond the current session and can be abused to maintain long-term execution.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrase 'auto repair' is very broad and could be activated by ordinary user requests that are not clearly intended to invoke this skill. In an agentic environment, ambiguous activation increases the chance of unintended execution of diagnostic or repair workflows, which may perform impactful system actions without sufficiently explicit user consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The feature list advertises auto-repair, task killing, session archiving, stale process cleanup, and HKCU\Run persistence, but does not prominently warn users that these are destructive or persistence-related behaviors. This omission can mislead users into invoking the skill without informed consent, increasing the chance of unexpected system modification or data loss.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are generic natural-language requests like 'check what's wrong with Gateway' and 'auto repair', which can easily overlap with ordinary user intent and cause the skill to activate in situations the user did not explicitly mean to invoke this package. In this skill's context, unintended activation is more dangerous because the documented behavior includes process termination, file archiving, automatic repair actions, and optional persistence mechanisms.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: Sending detailed stack traces and full diagnostic context through Feishu can expose secrets, filesystem paths, environment-derived values, tokens, user content, or internal runtime state to an external messaging channel. In a diagnostic skill, this context often contains precisely the sensitive material attackers or unauthorized recipients would want, so the surrounding skill purpose makes the disclosure risk more acute, not less.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: 文档在 Watchdog 功能中描述了自动修复、残留进程清理、注册开机自启、发送通知等会影响系统与外部通信的行为，但未在相邻位置明确警告用户这些副作用。用户可能在未充分理解影响的情况下启用后台守护或安装自启动，造成意外进程终止、文件归档或对外消息发送。

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: README 建议的触发短语如“check what's wrong with Gateway”“auto repair”非常通用，容易与普通对话或运维讨论重叠。在会执行诊断、修复、重启、归档等动作的技能上下文中，这种宽泛触发会增加误调用风险，导致非预期的系统变更。

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/watchdog_monitor.py:73