OpenClaw Release Validation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 0.1.7

Overview

The skill is mostly coherent release-validation tooling, but it asks an agent to run a mutable remote installer directly through Bash, which needs human review before installation.

Review this skill carefully before installing. Its release-validation workflow is explicit and user-gated, but do not allow the OCM install command unless you trust the current OpenClaw OCM release asset and are comfortable running a remote installer with your user permissions. Prefer installing OCM yourself through a pinned or verified method, then use the skill without the pipe-to-Bash path.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:353

Finding

Unverified Mutable Remote Installer Executed Through a Shell Pipeline

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 353
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Code Snippet

sh

curl -fsSL https://github.com/openclaw/ocm/releases/latest/download/install.sh | bash

Technical Analysis

The Skill instructs the agent to download an installation script from a mutable latest release URL and pipe it directly into Bash. The payload is executed without:

• Pinning an immutable OCM version or release asset.
• Verifying a cryptographic checksum or digital signature.
• Validating a signed release attestation.
• Saving the script for inspection before execution.
• Confirming that redirects resolve to an expected immutable artifact.

Installation is consent-gated and the URL belongs to the declared OpenClaw GitHub organization, which reduces accidental execution risk. However, user approval does not establish the integrity of the downloaded bytes. The effective code can change after the Skill package has been reviewed.

This behavior exceeds the minimum privilege necessary to install OCM safely because the invoking shell grants the remote script all permissions available to the current user. A download-verify-execute flow could provide the same functionality with substantially lower supply-chain risk.

Attack Path

1. An attacker compromises the OpenClaw GitHub organization, OCM release process, release asset, or an account authorized to publish releases.
2. The attacker replaces or publishes a malicious install.sh asset addressed by the mutable latest URL. A compromised redirect or distribution path could produce an equivalent result.
3. A tester selects the isolated OCM workflow on a system where OCM is unavailable.
4. The tester gives the required install OCM approval.
5. The agent runs the documented command.
6. curl streams attacker-controlled content directly to Bash.
7. Bash executes the payload immediately with the agent user's permissions, ...[truncated 835 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to an explicit, reviewed OCM version rather than using latest.

2. Use an immutable release asset URL or content-addressed artifact.

3. Download the installer without executing it:

   sh

   curl --fail --show-error --location \
     --output "$installer" \
     "https://github.com/openclaw/ocm/releases/download/<pinned-version>/install.sh"
   

4. Verify a trusted, hard-coded SHA-256 digest before execution:

   sh

   printf '%s  %s\n' '<trusted-sha256>' "$installer" | sha256sum --check -
   

5. Prefer signature or release-attestation verification tied to a documented OpenClaw signing identity.

6. Reject unexpected redirects, ownership changes, digest mismatches, or failed provenance checks.

7. Execute the verified local file as an unprivileged user only after clearly displaying the pinned version and successful verification result.

8. Avoid requesting elevation. If elevated operations are genuinely necessary, isolate and separately approve only those specific operations.

9. Retain the existing post-install version check, but do not treat it as a substitute for pre-execution integrity verification.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using curl ... | bash combines remote retrieval and shell execution in a single step with no integrity validation or review point. In this skill's context, that is especially dangerous because the agent is instructed to perform privileged local setup as part of a release workflow, so successful tampering can immediately lead to arbitrary code execution and full compromise of the test host or developer environment.

Content

Scanner excerpt · SKILL.md (reported line 353)May include surrounding context.

it before continuing:

sh

curl -fsSL https://github.com/openclaw/ocm/releases/latest/download/install.sh | bash
ocm --version

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill explicitly instructs the agent to execute many networked and system-mutating commands, but the manifest declares no permissions or allowed-tools scope. That creates an over-privileged execution model where a host may grant broader tool access than the skill actually needs, increasing the blast radius of prompt injection, operator error, or misuse during release validation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes testing the latest OpenClaw main commit through an isolated copy or an explicitly approved gateway update, then guiding release feedback. This script not only validates installation state and checks for updates, but also constructs and emits a concrete openclaw skills update command, including --force when local modifications are detected, which crosses from validation into operational update enablement.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The skill directs the agent to fetch and execute a remote installer from a mutable latest URL on GitHub. This is a supply-chain risk: if the release asset, upstream account, network path, or hosting context is compromised, the agent will run attacker-controlled code on the local machine.

Content

Scanner excerpt · SKILL.md (reported line 353)May include surrounding context.

it before continuing:

sh

curl -fsSL https://github.com/openclaw/ocm/releases/latest/download/install.sh | bash
ocm --version

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

For a skill whose stated purpose is release validation and feedback, resolving OPENCLAW_HOME, OPENCLAW_STATE_DIR, and OPENCLAW_CONFIG_PATH to determine whether to emit --global update commands adds environment and installation-topology awareness aimed at modifying deployment scope. That capability is not strictly necessary for merely testing the latest commit or reporting structured release feedback.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script makes an HTTP request to the ClawHub API and includes identifying metadata such as the skill slug and owner in the request URL, but there is no confirmation prompt or user-facing notice in this file that a remote check will occur. For code files, outbound network activity should have some visible disclosure unless it is clearly communicated elsewhere or obviously expected from the skill's stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.