OpenClaw Docs

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:46 AM UTC
• Version: 1.1.0

Overview

The skill is a documentation helper, but it includes unsafe cache deletion logic and copyable configuration examples that could expose OpenClaw agents or gateways too broadly.

Review the scripts before use, set OPENCLAW_DOCS_CACHE_DIR to a dedicated cache folder, avoid cache.sh refresh unless that path is verified, do not run the suggested global npm install without vetting and pinning qmd, and harden copied snippets by requiring Discord mentions, scoping guild/channel IDs, and binding gateways to localhost unless deliberately exposing them with authentication and network controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/build-index.sh:14

Finding

Recommendation to Install an Unpinned Global npm Package

Content

View full analysis

Vulnerability Details

File Location: scripts/build-index.sh:14-19
Vulnerability Type: Unpinned global third-party dependency
Risk Level: Medium

Vulnerable Code

bash

build)
  echo "🔨 Building search index..."
  echo "⚠️  Feature requires 'qmd' package (install with: npm i -g qmd)"
  echo "   For now, use search.sh for keyword-based search"
  ;;

Technical Analysis

The script recommends installing qmd globally without specifying an audited version, package integrity hash, lockfile, or verified publisher. Consequently, npm resolves whichever release is currently associated with that package name.

npm packages can execute lifecycle scripts during installation. If the named package, its publisher account, or one of its transitive dependencies is compromised, following this recommendation could execute attacker-controlled code with the privileges of the user running npm. A global installation also places package executables or files in a shared npm prefix, increasing the affected scope compared with a project-local dependency.

The project does not automatically execute this installation command. Exploitation therefore requires a user to follow the displayed recommendation.

Attack Path

1. An attacker compromises the qmd package, its publisher account, or a transitive dependency, or causes an unsafe release to become the version resolved by npm.
2. A user runs the index build operation and sees the recommendation to execute npm i -g qmd.
3. The user runs that command without a pinned version or integrity verification.
4. npm downloads the currently resolved package and may run its lifecycle scripts.
5. Malicious lifecycle code executes as the installing user and may modify files, access that user's data, or install commands into the global npm prefix.

Impact Assessment

Exploit code would ordinarily inherit the privileges of the user invoking npm. It could read or alte ...[truncated 310 chars]

Remediation

View remediation

Remediation Suggestions

• Do not recommend an unversioned global installation.
• Identify and document the official package publisher and repository.
• Pin an audited exact version, for example qmd@X.Y.Z.
• Prefer a project-local development dependency recorded in package.json and a committed lockfile.
• Verify package integrity and review the package and its transitive dependencies before adoption.
• Avoid elevated installation privileges.
• Where practical, disable lifecycle scripts during installation and explicitly enable only reviewed build steps.
• Document the package's required permissions and provide an uninstall or rollback procedure.

T09 · Insecure Skill Coding Practices

Warning

• Location: snippets/common-configs.md:6

Finding

Discord Example Allows Unmentioned Messages from Every Configured Guild

Content

View full analysis

Vulnerability Details

File Location: snippets/common-configs.md:6-17
Vulnerability Type: Overly permissive provider configuration
Risk Level: Medium

Vulnerable Code

json

{
  "discord": {
    "token": "${DISCORD_TOKEN}",
    "guilds": {
      "*": {
        "requireMention": false
      }
    }
  }
}

Technical Analysis

The example combines a wildcard guild selector with requireMention disabled. If OpenClaw applies these settings as represented, the bot can process messages without an explicit mention across every guild covered by the wildcard.

This expands the Agent's input and trigger surface beyond explicitly addressed requests. Content posted by an untrusted guild member could be interpreted as an Agent request, potentially causing unwanted tool invocations, resource consumption, or exposure to prompt-injection content. The exact downstream effect depends on the permissions and tools assigned to the configured Agent.

Attack Path

1. An administrator copies the example without replacing the wildcard or enabling mention requirements.
2. The Discord bot is added to one or more guilds containing untrusted users.
3. An untrusted user posts crafted content in a channel visible to the bot without mentioning it.
4. The permissive configuration allows the message to enter the bot's processing flow.
5. The message influences Agent behavior within the limits of the bot's configured tools, credentials, and Discord permissions.

Impact Assessment

This configuration does not independently grant operating-system privileges. It can, however, let a broader population trigger the Agent. Resulting impact is bounded by the Agent's assigned capabilities and may include unauthorized task initiation, API or model-cost consumption, channel spam, disclosure of information available to the Agent, or actions performed through enabled tools.

Remediation

View remediation

Remediation Suggestions

• Set requireMention to true in the default example.
• Replace the wildcard with explicit trusted guild and channel identifiers.
• Document that wildcard configurations should not be used where guild membership is untrusted.
• Apply least privilege to the Discord bot's channel and role permissions.
• Require authorization checks before messages can invoke sensitive tools or administrative actions.
• Add rate limits, audit logging, and confirmation gates for consequential operations.
• Treat all Discord message content as untrusted input and isolate it from system-level Agent instructions.

T09 · Insecure Skill Coding Practices

Warning

• Location: snippets/common-configs.md:29

Finding

Gateway Example Binds the Service to All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: snippets/common-configs.md:29-37
Vulnerability Type: Unsafe network exposure default
Risk Level: Medium

Vulnerable Code

json

{
  "gateway": {
    "host": "0.0.0.0",
    "port": 8080
  }
}

Technical Analysis

Binding to 0.0.0.0 makes the gateway listen on every available IPv4 interface rather than only the local loopback interface. Depending on host networking, firewall rules, container port publication, and cloud security-group configuration, this can expose the gateway to other local-network or Internet clients.

The example provides no adjacent authentication, transport-encryption, reverse-proxy, trusted-network, or firewall controls. Binding to all interfaces does not itself prove that the gateway lacks application authentication, but it unnecessarily broadens network reachability and makes any separate authentication or gateway vulnerability easier to target.

Attack Path

1. A user copies the example and starts the gateway on a host with a reachable network interface.
2. Port 8080 is permitted by a host firewall, container publication rule, router, or cloud security group.
3. An attacker scans or otherwise discovers the exposed endpoint.
4. The attacker connects to the gateway and probes its exposed functions.
5. If authentication is absent, weak, or misconfigured, the attacker may invoke gateway functionality; otherwise, the expanded exposure still permits reconnaissance and denial-of-service attempts.

Impact Assessment

The confirmed impact is expansion of the gateway's network attack surface from local-only access to all bound interfaces. Further privileges depend on controls not shown in the snippet. In a weakly protected deployment, an attacker could potentially access gateway functions with the gateway process's application permissions. Even where authentication is present, the service may be exposed to brute-force attempt ...[truncated 59 chars]

Remediation

View remediation

Remediation Suggestions

• Use 127.0.0.1 as the secure default.
• Require an explicit opt-in before binding to 0.0.0.0.
• Add prominent warnings explaining the consequences of binding to all interfaces.
• Require strong authentication and authorization for every gateway operation.
• Terminate TLS through a securely configured reverse proxy or enable native transport encryption.
• Restrict ingress using host firewalls, container network policies, or cloud security groups.
• Allowlist trusted source networks and avoid directly publishing the gateway to the Internet.
• Add request limits, timeouts, audit logging, and monitoring for abusive access.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises a documentation navigation tool with cached doc fetch/search, sitemap/category routing, and config snippet lookup. This code chunk only provides a command dispatcher for fetch, build, and search, with fetch and build explicitly marked as unimplemented/planned and search merely delegating to another script for keyword search. There is no evidence in this chunk of sitemap routing, category handling, config snippet extraction, or actual index construction. While the code is related to OpenClaw docs tooling, its implemented behavior is substantially narrower and more incomplete than the declared purpose, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The script performs a destructive rm -rf using a path sourced from an external environment file, so the safety of the deletion depends entirely on OPENCLAW_DOCS_CACHE_DIR. If that variable is empty, malformed, or attacker-controlled, the globbed deletion can target unintended files and wipe arbitrary .md files outside the intended cache area.

Content

Scanner excerpt · scripts/cache.sh (reported line 35)May include surrounding context.

sh

refresh)
    echo "🔄 Refreshing cache..."
    rm -rf "$OPENCLAW_DOCS_CACHE_DIR"/*.md 2>/dev/null
    echo "✓ Cache cleared. Docs will be re-downloaded on next fetch."
    ;;

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the agent to execute multiple shell scripts, but the manifest does not declare any tool scope such as allowed-tools or permissions. That creates an authorization and review gap: consumers cannot tell from the skill metadata that command execution is required, and an agent may invoke shell unexpectedly when handling documentation tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.