OpenClaw Doc Finder

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:13 AM UTC
• Version: 1.2.0

Overview

This is a coherent OpenClaw documentation helper, but it includes under-scoped persistence, remote-fetch fallback behavior, and troubleshooting commands that can expose credentials or change security-sensitive configuration.

Review this skill before installing. Require explicit approval before any web fetch, curl command, cache write, lookup-record write, or version-sync run. Do not let it print raw `.env`, environment variable, API key, or gateway token values into chat or logs. Avoid the unpinned npx install fallback unless you pin and verify the source, and do not expose the gateway on `0.0.0.0` without private-network controls, authentication, and firewall restrictions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:194

Finding

Persistent Agent Memory Poisoning Through Unsanitized Lookup Records

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:96

Finding

Untrusted Remote Documentation Is Persisted Without Trust-Boundary Controls

Content

View full analysis

" | python3 -c " import sys, re html = sys.stdin.read() html = re.sub(r']*>.*?', '', html, flags=re.DOTALL) html = re.sub(r']*>.*?', '', html, flags=re.DOTALL) text = re.sub(r'<[^>]+>', ' ', html) text = re.sub(r' ', ' ', text) text = re.sub(r'\s+', ' ', text).strip() idx = text.find('。') if '。' in text else text.find('. ') if idx > 0: print(text[idx:idx+3000]) " ``` - Cache directory: `references/fetched/` - Write timing: immediately after a successful remote fetch ``` ### Technical Analysis Remote documentation is fetched and immediately converted into persistent local reference material. The HTML cleanup removes `script` and `style` elements, but it does not protect an AI Agent from textual prompt injection. Malicious instructions can be present in ordinary paragraphs, headings, image alternative text, hidden layout text, or compromised documentation content. The caching rules do not require: - Exact origin and path enforcement at execution time - Redirect restrictions - TLS certificate pinning or content signatures - Content-type and response-size validation - Prompt-injection detection - Provenance metadata - Isolation of cached text from instructions - Human review before persistent reuse The `curl` pipeline does not execute the downloaded page as shell or Python code. Therefore, it is not direct remote payload execution. The security issue is that untrusted network content is persisted and later supplied to the Agent as trusted context. ### Attack Path 1. A requested document is absent from local references and cac ...[truncated 903 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/troubleshoot.md:111

Finding

Credential Diagnostic Commands Disclose Complete Secret Values

Content

View full analysis

Remediation

View remediation

/' ``` Additional controls: 1. Never send raw credential values to the model. 2. Apply redaction to command output before logging or display. 3. Restrict `.env` permissions to the owning user, such as mode `0600`. 4. Prefer the platform's secret-management commands where they do not reveal values. 5. Warn users not to paste API keys into chat or support reports. 6. Rotate any credential that has already appeared in Agent output or logs. ]]>

T08 · Insecure Dependencies

Error

• Location: references/troubleshoot.md:68

Finding

Unpinned Third-Party Skill Installation Through npx

Content

View full analysis

` reports a rate limit: 1. Retry with a delay: `sleep 60 && clawhub install ` 2. Install manually from GitHub: `npx skills add ` 3. Use the internal SkillHub search ``` ### Technical Analysis The fallback recommends using `npx` to retrieve and run installation tooling against an arbitrary repository reference. It does not require: - An approved publisher or repository allowlist - An immutable commit identifier - A package version lock - A cryptographic checksum or signature - Source review - Inspection of lifecycle or installation scripts - Execution in an isolated environment The placeholder can also be populated from user-controlled input. A mutable branch, tag, repository, or package can change after review, creating a supply-chain execution path. Installation is an expected operation in this troubleshooting scenario, but executing an unverified and unpinned source exceeds the minimum safe privileges necessary for documentation lookup. ### Attack Path 1. A normal installation fails or encounters a rate limit. 2. The Skill recommends the GitHub-based `npx` fallback. 3. An attacker persuades the user or Agent to supply a malicious repository, or an approved repository is later compromised. 4. `npx` downloads the selected tooling and repository content. 5. Installation or lifecycle code runs with the invoking user's privileges. 6. The malicious dependency accesses files, credentials, network resources, or modifies the Agent environment. ### Impact Assessment Successful exploitation can execute code with the privileges of the user running `npx`. This may permit reading user files and secrets, modifying Skill content, installing persistent components, or making outbound network req ...[truncated 129 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/config-guide.md:48

Finding

Remote-Access Guidance Binds the Gateway to All Interfaces Without Mandatory Safeguards

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

This duplicate finding points to the same risky construct: a shell-based curl retrieval template for external content. The skill context makes it more dangerous because the workflow mandates trying this fallback after other fetch methods fail, increasing the likelihood that command execution will actually occur during normal use.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

4. 提供手动查询链接

text

### curl 降级命令模板

```bash
# 文档 URL 格式：https://docs.openclaw.ai/<path>

External Script Fetching

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

This duplicate finding points to the same risky construct: a shell-based curl retrieval template for external content. The skill context makes it more dangerous because the workflow mandates trying this fallback after other fetch methods fail, increasing the likelihood that command execution will actually occur during normal use.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

4. 提供手动查询链接

text

### curl 降级命令模板

```bash
# 文档 URL 格式:https://docs.openclaw.ai/<path>

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The documentation tells users to run cat ~/.openclaw/.env | grep -i API_KEY, which reads secret-bearing material from a credential file and encourages displaying it in the terminal. Even if filtered, this can reveal full API keys and creates a high risk of accidental disclosure through screenshots, scrollback, support transcripts, or recording tools.

Content

Scanner excerpt · references/troubleshoot.md (reported line 168)May include surrounding context.

md

openclaw config get plugins.allow
openclaw config get plugins.entries.<provider>.enabled

# 确认 API key 是否在 .env
cat ~/.openclaw/.env | grep -i API_KEY

# 确认 imageGenerationModel 配置

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This finding is part of the same credential-inspection workflow and encourages handling .env contents in a way that can disclose sensitive API keys. In troubleshooting docs, such instructions are especially dangerous because users often share exact terminal output with others, amplifying the chance of compromise.

Content

Scanner excerpt · references/troubleshoot.md (reported line 169)May include surrounding context.

md

openclaw config get plugins.entries.<provider>.enabled

# 确认 API key 是否在 .env
cat ~/.openclaw/.env | grep -i API_KEY

# 确认 imageGenerationModel 配置
openclaw config get agents.defaults.imageGenerationModel

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The command echo 'GEMINI_API_KEY=your_key' >> ~/.openclaw/.env embeds a credential directly in shell input, which can persist in shell history and leak through terminal capture or operational monitoring. Because the document is a step-by-step runbook, users are likely to copy it verbatim, making the unsafe secret-entry pattern more dangerous in context.

Content

Scanner excerpt · references/troubleshoot.md (reported line 181)May include surrounding context.

1. 添加 API key 到 .env（daemon 环境不读 openclaw.json 的 env 块）：

   bash

   echo 'GEMINI_API_KEY=your_key' >> ~/.openclaw/.env
   

2. 把 provider 加入 plugins.allow：

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill directs the agent to perform remote network fetches and then automatically cache results to local files, but it does not require explicit user consent or even a user-facing notice before doing so. This can cause unexpected outbound requests and local state modification, which is risky in agent environments where network access and filesystem writes may expose data, alter future behavior, or violate user expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The fallback path explicitly instructs shell-based network access via curl and pipes untrusted remote content into a Python interpreter pipeline, yet no user-visible approval step is required. Even though the Python snippet is inline, this still expands the attack surface by combining shell execution, remote content retrieval, and hidden network activity without consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation explicitly instructs users how to print the current gateway authentication token, which increases the chance that sensitive credentials are exposed in terminals, logs, screen recordings, shell history, or shared troubleshooting output. In a gateway/admin configuration guide, this is more dangerous because the token appears to grant access to the gateway and the doc provides no warning or safer handling guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all diagnostic instructions, labels, and command guidance exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file is in scope for vague-trigger checks, and the table labeled '意图 → 文档路由表' presents '场景关键词' as the activation signal but fills entries with '...' rather than specific keywords. That leaves the routing condition undefined and overly ambiguous, making it unclear what user language should match each document versus what should not.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents the skill reference entirely in Chinese, including the title and operating instructions, with no indication that language is optional or limited to a China-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The troubleshooting section instructs users to inspect provider configuration and environment variables for API-related values without any privacy warning, increasing the chance that secrets are exposed in terminal history, screenshots, logs, or copied support output. In a troubleshooting context, users are especially likely to paste command output into chats or tickets, which makes credential leakage materially more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The example appends an API key directly from the shell command line into ~/.openclaw/.env, which risks exposing the key via shell history, process inspection, terminal logging, or copied command transcripts. This is a real secret-handling weakness in documentation because it normalizes an unsafe pattern for entering credentials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file’s primary natural-language documentation is entirely in Chinese, including the script description, purpose, and usage notes, with no indication that language selection is optional or that the skill is intentionally region-specific. Under the policy, forcing a specific language without user opt-in is a locale-policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill is presented as a Chinese-language documentation expert (官方文档检索专家) and the operational text is written to produce responses in that locale, while English is only mentioned for activation phrases. There is no explicit statement that users may choose their preferred language for responses, which can be a locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This file opens with a Chinese title and headings and does not state that language selection is optional, even though the index contains multilingual content later in the file. Because policy checks apply to all file types, presenting the index in a single language without an explicit opt-in or language-choice note can be read as a locale preference imposed on users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file presents all user-facing troubleshooting guidance exclusively in Chinese and does not indicate that language selection is optional or context-specific. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.