Security audit

OpenClaw Helper

Security checks for vulnerabilities and agentic risk

Overview

This OpenClaw deployment helper is coherent, but its templates normalize risky credential handling and an open Feishu bot access policy without enough warnings.

Review the command templates before installing or using this skill. Do not paste real API keys or Feishu secrets into shared chats, transcripts, screenshots, or shell commands that may be logged; prefer a protected secret flow if OpenClaw supports one. Change the Feishu group policy to a restricted setting or use explicit allowlists before production use, and avoid routine root-based operation when a dedicated low-privilege service account is available.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:37
Finding: API and application secrets exposed through command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 37–50 and 58–67 **Vulnerability Type**: Sensitive credentials passed through command-line arguments **Risk Level**: High ### Vulnerable Code ```bash ssh root@<IP> 'export NVM_DIR=/root/.nvm; . "$NVM_DIR/nvm.sh"; openclaw config set "models.providers.<名称>" --json "{ \"baseUrl\": \"<代理地址>\", \"apiKey\": \"<API_Key>\", \"api\": \"anthropic-messages\", \"models\": [{ \"id\": \"claude-sonnet-4-6\", \"name\": \"Claude Sonnet 4.6\", \"reasoning\": true, \"input\": [\"text\", \"image\"], \"contextWindow\": 200000, \"maxTokens\": 32000 }] }"' ``` ```bash ssh root@<IP> 'export NVM_DIR=/root/.nvm; . "$NVM_DIR/nvm.sh"; openclaw config set "channels.feishu" --json "{ \"enabled\": true, \"domain\": \"feishu\", \"groupPolicy\": \"open\", \"appId\": \"<App_ID>\", \"appSecret\": \"<App_Secret>\" }"' ``` ### Technical Analysis The documented commands place an AI provider API key and a Feishu application secret directly inside SSH command-line arguments. After users replace the placeholders, the complete secrets can be exposed through: - Local shell history. - Terminal session recording and clipboard history. - CI/CD or automation logs that echo commands. - Operating-system process inspection while the command is running. - SSH wrappers, auditing systems, or administrative session logs. - Persisted OpenClaw configuration if its file permissions are overly broad. Quoting the remote command does not remove this risk. The initiating shell still receives and may record the complete command, and the SSH client receives the remote command as an argument. ### Attack Path 1. An administrator replaces the placeholders with a valid provider API key or Feishu application secret. 2. The administrator executes the documented SSH command. 3. The command is retained in shell history, a session transcript, an automation log, or process metadata. 4. An attacker with read acc ...[truncated 793 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not place API keys or application secrets directly in command-line arguments. 2. Use OpenClaw's supported secret store, protected environment-file integration, or credential-provider mechanism where available. 3. If interactive input is required, read secrets without terminal echo and pass them through standard input or a protected file descriptor rather than the process argument list. 4. Create temporary configuration files only with restrictive permissions such as `0600`, avoid shared temporary directories, and securely remove temporary material after use. 5. Ensure the resulting OpenClaw configuration is owned by the dedicated service account and is not readable by other users. 6. Disable command echoing around secret-handling steps in automation and configure CI/CD systems to mask all relevant credentials. 7. Add explicit warnings that shell history and session recording must not retain substituted commands. 8. Rotate any credential previously entered using these command templates if command histories or logs may have been accessible. 9. Prefer short-lived, scope-limited credentials and configure provider-side usage limits, network restrictions, and monitoring. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:58
Finding: Feishu integration defaults to an unrestricted group access policy<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 58–67 **Vulnerability Type**: Overly permissive access-control configuration **Risk Level**: Medium ### Vulnerable Code ```bash ssh root@<IP> 'export NVM_DIR=/root/.nvm; . "$NVM_DIR/nvm.sh"; openclaw config set "channels.feishu" --json "{ \"enabled\": true, \"domain\": \"feishu\", \"groupPolicy\": \"open\", \"appId\": \"<App_ID>\", \"appSecret\": \"<App_Secret>\" }"' ``` ### Technical Analysis The deployment template enables the Feishu channel with `"groupPolicy": "open"`. The guide does not pair this setting with an approved-user or approved-group allowlist, an authorization check, or a warning explaining the resulting exposure. An open policy creates a broader interaction boundary than a least-privilege deployment requires. Any Feishu user able to reach the bot under the surrounding tenant and application configuration may be able to submit requests. The consequences depend on the tools, data sources, model quota, and system permissions assigned to the OpenClaw agent. ### Attack Path 1. An administrator deploys the Feishu integration using the provided configuration without changing `groupPolicy`. 2. The bot becomes available in a group or context accessible to an untrusted or insufficiently authorized Feishu user. 3. The user submits prompts or repeated requests to the bot. 4. OpenClaw processes those requests under the bot's configured identity and capabilities. 5. If the agent has access to sensitive tools, data, or paid model capacity, the user may consume those resources or exercise capabilities that were intended only for trusted users. This path requires the attacker to have access to a Feishu context in which the deployed bot is reachable. It does not independently bypass Feishu tenant controls. ### Impact Assessment Potential impact includes unauthorized model consumption, quota exhaustion, increased operating costs, exposure of information available to the age ...[truncated 361 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the open default with the most restrictive supported group policy. 2. Maintain explicit allowlists of approved Feishu users and groups. 3. Require authorization checks before processing requests or invoking tools with side effects. 4. Separate low-risk conversational functions from privileged administrative or data-access tools. 5. Grant the Feishu application only the minimum API scopes required for its intended operation. 6. Run OpenClaw under a dedicated, unprivileged operating-system account rather than using unrestricted root access for routine operations. 7. Apply model quotas, per-user rate limits, request logging, and alerts for unusual usage. 8. Document the security implications of selecting an open policy and require administrators to opt into it explicitly. 9. Test access controls using both approved and unapproved Feishu accounts before production deployment. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The description, trigger section, and example invocations are all written only in Chinese, including the activation examples, which implies a fixed language expectation. The file does not state that the skill is China-specific or offer users an opt-in or alternative language, which can violate language/locale policy requirements.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill includes a command template that writes Feishu App ID and App Secret directly into persistent OpenClaw configuration, but it provides no warning about secret exposure in shell history, terminal logs, shared transcripts, or configuration file permissions. In this context, the skill is operational guidance rather than obviously malicious content, but normalizing direct pasting of credentials into commands increases the chance of accidental secret disclosure and unauthorized access to the messaging integration.

Static analysis

No suspicious patterns detected.