Safe Config Workflow

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:48 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent OpenClaw configuration workflow, but it needs review because it can persist learned configuration details and surface logs without enough redaction or user control.

Review before installing if your OpenClaw configuration or logs may contain tokens, credentials, private endpoints, or account details. The skill should ideally redact sensitive values, show proposed MEMORY.md entries before writing them, and require explicit consent for persistent memory updates.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:197

Finding

Mandatory Persistent Agent Memory Updates Can Poison Future Sessions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:197-201
Vulnerability Type: Persistent agent memory poisoning
Risk Level: Medium

The following is an English translation of the complete relevant source segment:

markdown

**Operations the AI must perform:**
1. Filter the doctor output and extract key repair information
2. Compare the backup file and interpret the diff
3. Report the repaired field, original value, and new value to the user
4. Record the lesson in MEMORY.md
5. Wait three seconds and verify the Gateway status

This requirement is also reinforced at SKILL.md:29-31, SKILL.md:60-62, and SKILL.md:209, as well as TEST-GUIDE.md:150-151.

Technical Analysis

The workflow mandates writing lessons derived from configuration repairs into the persistent MEMORY.md file. It does not require separate user approval for this persistent write, define an allowlist of permissible facts, sanitize diagnostic or configuration-derived content, establish retention limits, or provide a review and rollback process.

Configuration data and diagnostic output may be influenced by an attacker, a compromised integration, or an incorrectly configured system. If the agent interprets such content as a valid lesson and stores it, the resulting rule can continue to influence later sessions. This changes the operation from temporary task execution into persistent modification of agent state.

The vulnerability does not establish arbitrary code execution by itself. Exploitation depends on the agent having permission to modify its persistent memory and later consulting that memory.

Attack Path

1. An attacker or faulty integration introduces misleading configuration data or causes misleading repair diagnostics.
2. The user invokes this configuration workflow.
3. The agent runs the repair process and interprets the attacker-influenced output as a reusable configuration lesson.
4. The mandatory workflow ca ...[truncated 1143 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional requirement to update MEMORY.md.
2. Require explicit, separate user confirmation before every persistent memory write.
3. Store only structured and allowlisted facts, such as a validated field name, schema version, approved value, authoritative source, and timestamp.
4. Never persist raw logs, authentication tokens, secrets, full configuration fragments, or uncontrolled user and tool output.
5. Validate every proposed lesson against the official schema and trusted documentation before storage.
6. Show the exact proposed memory entry to the user before writing it.
7. Scope entries to this specific skill and configuration version rather than using unrestricted global memory.
8. Add expiration, provenance, review, deletion, and rollback mechanisms.
9. Treat doctor output, log content, configuration values, and external documentation as untrusted data rather than instructions.
10. Prefer a task-local audit record over behavioral memory when persistence is not necessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill repeatedly instructs the agent to record 'learned' configuration details into MEMORY.md, but it provides no guardrails against persisting secrets, tokens, endpoint credentials, or sensitive environment-specific values derived from ~/.openclaw/openclaw.json. Because this workflow explicitly handles authentication and channel configuration, the memory step can turn transient secret exposure into durable storage and later unintended disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The troubleshooting flow tells the agent to retrieve and present logs, including follow mode output, without any instruction to treat logs as sensitive. Logs commonly contain secrets, tokens, file paths, internal hostnames, stack traces, and user data, so surfacing them directly to the user or model can leak sensitive information beyond what is necessary for diagnosis.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file contains user-facing operational instructions exclusively in Chinese, including warnings, procedures, and expected results. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest declares the skill language as "zh-CN", which is a natural-language locale restriction. In this file there is no indication that users can opt into another language or that the locale limitation is justified as region-specific, so it may violate the language/locale policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.