Openclaw Security Guard

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:25 PM UTC
• Version: 1.0.0

Overview

This is a real security-audit tool, but it has under-disclosed external script loading and risky auto-fix and git-hook behavior that users should review before installing.

Install only after reviewing the auto-fix, dashboard, and hooks behavior. Prefer audit and dry-run modes first, avoid fix --auto on important OpenClaw configs until backups are verified, and do not use the dashboard in sensitive environments unless external CDN script loading is removed or pinned. Use hooks install only in repositories where replacing the existing pre-commit hook is acceptable.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: src/hardening/auto-hardener.js:26

Finding

Asynchronous Permission Fixes Can Erase the OpenClaw Configuration

Content

View full analysis

{ await fs.chmod(filePath, 0o600); } ``` The hardener treats every fix as a synchronous configuration transformation: ```js // Apply each auto-fixable issue for (const issue of issues) { if (issue.autoFixable && issue.autoFix) { config = issue.autoFix(config); } } // Write updated config await fs.writeFile( configPath, JSON.stringify(config, null, 2), 'utf-8' ); ``` ### Technical Analysis Configuration fixes return the modified configuration object synchronously, while permission fixes are declared as `async` functions and return a Promise. `AutoHardener.applyFixes()` does not await the result and unconditionally assigns it to `config`. When a permission fix is processed, `config` becomes a Promise rather than the parsed OpenClaw configuration. Serializing a Promise with `JSON.stringify()` produces `{}`, so the final write can replace the complete `openclaw.json` file with an empty JSON object. If additional fixes follow the permission fix, they may receive a Promise where a normal configuration object is expected, potentially causing exceptions or additional incorrect mutations. ### Attack Path 1. An OpenClaw installation contains `openclaw.json`, `credentials.json`, or `.env` with world-readable or world-writable permissions. 2. `ConfigAuditor.checkFilePermissions()` creates an asynchronous `autoFix` finding. 3. The user runs `openclaw-guard fix` and approves the changes, or runs `openclaw-guard fix --auto`. 4. `AutoHardener.applyFixes()` invokes the asynchronous callback without `await`. 5. The returned Promise is as ...[truncated 831 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: src/dashboard/server.js:270

Finding

Dashboard Executes Mutable Third-Party JavaScript Despite Local-Only Privacy Claims

Content

View full analysis

🛡️ Setup ``` ```html 🛡️ Login ``` The authenticated dashboard loads several externally hosted executable resources: ```html ``` The same application stores its bearer-style session identifier in browser local storage: ```js localStorage.setItem('session', d.sessionId); ``` ```js const sid = localStorage.getItem('session'); if (!sid) { location.href = '/'; return; } const ws = new WebSocket('ws://' + location.host + '?session=' + sid); ``` This conflicts with the public privacy declaration in `src/index.js:46-51`: ```js export const PRIVACY = { telemetry: false, tracking: false, externalRequests: false, dataCollection: false }; ``` ### Technical Analysis Opening the dashboard causes the browser to retrieve and execute JavaScript from `unpkg.com` and `cdn.tailwindcss.com`. The URLs are not protected with Subresource Integrity, and the server does not establish a restrictive Content Security Policy. The downloaded scripts execute in the local dashboard's origin and can therefore interact with its DOM, read its `localStorage`, obtain the session identifier, create authenticated WebSocket connections, inspect dashboard security state, alter displayed results, and initiate outbound net ...[truncated 2014 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Warning

• Location: src/cli/index.js:402

Finding

Git Hook Installation Silently Replaces Existing Pre-Commit Controls and Uses Network-Capable npx Resolution

Content

View full analysis

') .description('Manage git hooks (install|uninstall|status)') .action(async (action) => { const hookPath = '.git/hooks/pre-commit'; switch (action) { case 'install': const script = `#!/bin/bash # OpenClaw Security Guard - Pre-commit Hook # Scans for secrets before allowing commit echo "🛡️ Running security scan..." npx openclaw-guard scan secrets --quick if [ $? -ne 0 ]; then echo "❌ Security check failed! Commit blocked." echo " Run 'openclaw-guard scan secrets' for details." exit 1 fi echo "✅ Security check passed" `; try { await fs.mkdir('.git/hooks', { recursive: true }); await fs.writeFile(hookPath, script, { mode: 0o755 }); console.log(chalk.green('✅ Pre-commit hook installed')); console.log(chalk.dim(' Secrets will be scanned before each commit')); } catch (e) { console.log(chalk.red('❌ Failed to install hook:'), e.message); } break; ``` ### Technical Analysis The installer writes directly to `.git/hooks/pre-commit` without checking whether a hook already exists, requesting confirmation, preserving a backup, or chaining the existing hook. As a result, a repository's existing linting, signing, policy enforcement, secret scanning, or other security controls can be silently removed. The replacement hook invokes: ```sh npx openclaw-guard scan secrets --quick ``` Depending on npm configuration and local package availability, `npx` may resolve or download a package at commit time. This introduces network-capable package resolution into a security-sensitive persistent hook. It also means the code executed by a commit may not be the exact reviewed installation. Hook installation is exp ...[truncated 1407 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (118)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill metadata markets a security audit CLI and dashboard, but the content also promotes fix --auto and "auto-hardening," which are materially different from passive analysis because they write or regenerate configuration. In a security tool context this is especially sensitive: users may run it on production or developer environments assuming observation-only behavior, while it can alter security posture and break workflows or introduce unsafe defaults.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill metadata markets a security audit CLI and dashboard, but the content also promotes fix --auto and "auto-hardening," which are materially different from passive analysis because they write or regenerate configuration. In a security tool context this is especially sensitive: users may run it on production or developer environments assuming observation-only behavior, while it can alter security posture and break workflows or introduce unsafe defaults.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill metadata markets a security audit CLI and dashboard, but the content also promotes fix --auto and "auto-hardening," which are materially different from passive analysis because they write or regenerate configuration. In a security tool context this is especially sensitive: users may run it on production or developer environments assuming observation-only behavior, while it can alter security posture and break workflows or introduce unsafe defaults.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill metadata markets a security audit CLI and dashboard, but the content also promotes fix --auto and "auto-hardening," which are materially different from passive analysis because they write or regenerate configuration. In a security tool context this is especially sensitive: users may run it on production or developer environments assuming observation-only behavior, while it can alter security posture and break workflows or introduce unsafe defaults.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill metadata markets a security audit CLI and dashboard, but the content also promotes fix --auto and "auto-hardening," which are materially different from passive analysis because they write or regenerate configuration. In a security tool context this is especially sensitive: users may run it on production or developer environments assuming observation-only behavior, while it can alter security posture and break workflows or introduce unsafe defaults.

Content

No source excerpt is available for this finding.

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · docs/api/programmatic.md (reported line 25)May include surrounding context.

console.log(Score: ${results.securityScore}/100);

// Check for prompt injection const check = await checkPromptInjection('ignore previous instructions'); console.log(Safe: ${check.safe});

text

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · docs/en/README.md (reported line 439)May include surrounding context.

console.log(Score: ${results.securityScore}/100);

// Check for prompt injection const check = await checkPromptInjection('ignore previous instructions'); console.log(Safe: ${check.safe});

text

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · docs/fr/README.md (reported line 348)May include surrounding context.

console.log(Score: ${results.securityScore}/100);

// Check for prompt injection const check = await checkPromptInjection('ignore previous instructions'); console.log(Safe: ${check.safe});

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/api/programmatic.md (reported line 309)May include surrounding context.

// Returns: '/home/user/config.json'

// Dangerous path - throws error sanitizePath('../../../etc/passwd', '/home/user'); // Throws: Error('Path traversal detected')

text

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · docs/en/README.md (reported line 439)May include surrounding context.

md

-|----------------|
| Sandbox mode | Critical | Set to `always` |
| DM policy | High | Set to `pairing` |
| Gateway bind | Critical | Set to `loopback` |
| Elevated mode | High | Disable |
| Rate limiting | Medium | Enable |
| Cost limits | Medium | Set limits |

### Prompt Injection Detector

Detects prompt injection patterns in logs and messages.

**Categories:**

1. **Instruction Override** - "ignore previous instructions"
2. **Role Manipulation** - "you are now DAN"
3. **System Prompt** - "system: ..."
4. **Jailbreak** - Known jailbreak phrases
5. **Code Execution** - Attempts to execute code
6. **Data Extraction** - Attempts to extract data

**Sensitivity Levels:**

| Level | Description |
|-------|-------------|
| `low` | Only obvious attacks |
| `medium` | Balanced detection (default) |
| `high` | Aggressive detection (may have false positives) |

---

## Configuration

### Config File Location

Create `.openclaw-guard.json` in:
- Project directory (highest priority)
- Home dire

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/ar/README.md (reported line 237)May include surrounding context.

bash

# Delete auth file and restart
rm ~/.openclaw-security-guard/auth.json
openclaw-guard dashboard

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/en/README.md (reported line 379)May include surrounding context.

bash

# Delete auth file and restart
rm ~/.openclaw-security-guard/auth.json
openclaw-guard dashboard

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/fr/README.md (reported line 302)May include surrounding context.

bash

# Delete auth file and restart
rm ~/.openclaw-security-guard/auth.json
openclaw-guard dashboard

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/guides/getting-started.md (reported line 188)May include surrounding context.

bash

# Delete auth file and restart
rm ~/.openclaw-security-guard/auth.json
openclaw-guard dashboard

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · README.md (reported line 232)May include surrounding context.

md

* @example
 * ```javascript
 * import { checkPromptInjection } from 'openclaw-security-guard';
 * const result = checkPromptInjection('ignore all previous instructions');
 * if (!result.safe) console.log('Injection detected!');
 * ```
 */

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · docs/api/programmatic.md (reported line 133)May include surrounding context.

md

* @example
 * ```javascript
 * import { checkPromptInjection } from 'openclaw-security-guard';
 * const result = checkPromptInjection('ignore all previous instructions');
 * if (!result.safe) console.log('Injection detected!');
 * ```
 */

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · docs/en/README.md (reported line 565)May include surrounding context.

md

* @example
 * ```javascript
 * import { checkPromptInjection } from 'openclaw-security-guard';
 * const result = checkPromptInjection('ignore all previous instructions');
 * if (!result.safe) console.log('Injection detected!');
 * ```
 */

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · docs/fr/README.md (reported line 447)May include surrounding context.

md

* @example
 * ```javascript
 * import { checkPromptInjection } from 'openclaw-security-guard';
 * const result = checkPromptInjection('ignore all previous instructions');
 * if (!result.safe) console.log('Injection detected!');
 * ```
 */

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · src/index.js (reported line 113)May include surrounding context.

js

* @example
 * ```javascript
 * import { checkPromptInjection } from 'openclaw-security-guard';
 * const result = checkPromptInjection('ignore all previous instructions');
 * if (!result.safe) console.log('Injection detected!');
 * ```
 */

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/scanners/config-auditor.js (reported line 376)May include surrounding context.

js

async checkFilePermissions(basePath, findings, summary) {
    const sensitiveFiles = [
      'openclaw.json',
      'credentials.json',
      '.env'
    ];

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file exposes auto-fix callbacks that can change permissions on sensitive files like .env and credentials.json via fs.chmod. If an upstream caller applies these fixes automatically, the tool will modify security-sensitive filesystem state without any warning or approval mechanism visible here, which can cause unintended operational impact or unsafe changes in multi-user environments.

Content

No source excerpt is available for this finding.

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · src/scanners/mcp-server-auditor.js (reported line 79)May include surrounding context.

js

findings.push({
          type: 'mcp-server',
          severity: 'medium',
          message: `Could not read MCP config: ${error.message}`
        });
        summary.medium++;
      }

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · src/scanners/prompt-injection-detector.js (reported line 26)May include surrounding context.

js

/system\s*:\s*you\s+are\s+now/gi
    ],
    severity: 'critical',
    description: 'Attempts to override system instructions'
  },
  
  // Role hijacking

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · src/scanners/prompt-injection-detector.js (reported line 56)May include surrounding context.

js

/forward\s+(all|this)\s+.*(to|via)/gi
    ],
    severity: 'critical',
    description: 'Attempts to send data to external services'
  },
  
  // Code execution

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · src/scanners/prompt-injection-detector.js (reported line 152)May include surrounding context.

js

/unicode\s+(escape|encoded)/gi
    ],
    severity: 'medium',
    description: 'Attempts to bypass filters using encoding'
  },
  
  // Tool manipulation

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.potential_exfiltration (+1 more)

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/scanners/mcp-server-auditor.js:27

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: src/scanners/mcp-server-auditor.js:26

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: src/dashboard/server.js:50

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: docs/api/programmatic.md:25

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: docs/en/README.md:439

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: docs/fr/README.md:348

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: README.md:232