Security audit

AI Compliance

Security checks for vulnerabilities and agentic risk

Overview

This compliance skill is mostly reference material, but it embeds apparent fi.com operational data and gives under-scoped guidance for accessing internal telemetry and creating persistent plaintext secret files.

Review before installing. Remove or clearly fictionalize all fi.com current-state data, event counts, training statistics, inventory records, and personal names. Tighten playbooks so internal telemetry and raw prompts are accessed only by authorized roles with scoped queries, redaction, audit logging, and legal/privacy review. Replace the /etc/openclaw/secrets.env quick fix with managed secret storage or a clearly temporary, approved break-glass procedure.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/incident-response.md:8
Finding: Unrestricted Access Guidance for Raw Prompts and Internal Telemetry
Content: View full analysis
Vulnerability Details

File Location: references/incident-response.md:8-11, 19-20; references/remediation-playbooks.md:33, 74, 95-98
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code Snippets:

references/incident-response.md:8-11

text
### Immediate (0–1 hour) 1. Identify the user, tool, timestamp, and nature of data entered 2. Pull raw prompt from webhook_events or DLP logs if available 3. Determine data classification: Restricted / Confidential / Internal / Public

references/incident-response.md:19-20

text
10. Assess blast radius: was this a one-time entry or pattern of behavior? 11. Check webhook_events for similar events from same user or data type

references/remediation-playbooks.md:33

text
1. Pull the specific event(s) from webhook_events — identify user, tool, timestamp, and what credential was entered

references/remediation-playbooks.md:74

text
1. Pull list of active AI users from webhook_events who lack training_completions records

references/remediation-playbooks.md:94-98

text
2. Run a discovery process: - Query webhook_events for all unique genai_app_name values - Survey department heads for AI tools in use - Check SaaS spend/procurement records for AI vendor payments - Review browser extension data for AI site categories

Technical Analysis

The playbooks instruct an operator or tool-enabled agent to retrieve raw prompts, DLP records, employee activity, training records, procurement records, and browser-extension telemetry. These sources may contain credentials, personal information, MNPI, confidential business content, and detailed records of employee behavior.

The instructions do not require the agent to verify the requester's authorization, use a narrowly scoped service account, retrieve metadata before content, redact sensitive values, ...[truncated 1547 chars]
Remediation: View remediation
Remediation Suggestions

Require explicit authorization before querying any internal telemetry source.

Document approved roles for access to prompts, DLP events, employee records, procurement data, and browser telemetry.

Use dedicated read-only service accounts with row-, tenant-, and time-range restrictions.

Retrieve event metadata first; allow raw prompt retrieval only when strictly necessary and separately approved.

Redact credentials, tokens, personal data, MNPI, and confidential content before records enter the model context.

Prohibit reproducing raw prompts or secret values in generated reports.

Add purpose limitation, retention periods, audit logging, and secure deletion requirements.

Require legal or privacy review where employee monitoring or personal-data processing is involved.

Replace broad discovery instructions with explicitly approved data sources and bounded queries.

T09 · Insecure Skill Coding Practices

Warning

Location: references/remediation-playbooks.md:107
Finding: Overbroad Credential Reconnaissance and Unsafe Privileged Secrets-File Setup
Content: View full analysis
Vulnerability Details

File Location: references/remediation-playbooks.md:107-130
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code Snippet:

text
## Playbook R-6: Secrets/Credentials in Cron Jobs or Config Files **Frameworks:** NIST MEASURE 2.7, ISO A.8.2 **Severity:** HIGH **Steps:** 1. Audit all config files, cron job payloads, and environment files for plaintext credentials 2. Move credentials to a secrets manager: - Linux: use environment variables sourced from a secured `.env` file (chmod 600) - Better: HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault - Quick option: store in `/etc/openclaw/secrets.env` with strict permissions, source at runtime 3. Rotate all credentials that were stored in plaintext — assume exposed 4. Implement secret scanning in CI/CD pipeline (e.g., GitGuardian, truffleHog) 5. Add pre-commit hook to catch secrets before they're committed 6. Document secret management approach in runbook **Quick fix for OpenClaw specifically:** ```bash # Create secured env file sudo mkdir -p /etc/openclaw sudo nano /etc/openclaw/secrets.env # Add: DB_PASS=... SMTP_PASS=... sudo chmod 600 /etc/openclaw/secrets.env sudo chown bcaddy:bcaddy /etc/openclaw/secrets.env

text
### Technical Analysis The instruction to audit “all” configuration files, cron payloads, and environment files creates an unnecessarily broad credential-discovery operation. If performed by a privileged agent, secret values could be copied into command output, logs, or the model context. The quick fix also requires `sudo`, uses an interactive editor for secret entry, and assigns ownership to the hardcoded local account `bcaddy`. The Skill does not verify that this account exists, owns the service, or should receive access to the secrets. The file is created before its final permissions are applied. Depending on the current `umask` and ...[truncated 1436 chars]
Remediation: View remediation
Remediation Suggestions

Replace “audit all files” with an allowlist of approved application paths and file types.

Require administrator authorization before filesystem or scheduled-task inspection.

Ensure scanners report file locations and secret types without returning secret values.

Prefer an approved secrets manager rather than a plaintext .env file.

Remove the hardcoded bcaddy identity and obtain the service account from verified deployment configuration.

Validate that the destination directory and service identity are expected before applying changes.

Create files atomically with restrictive permissions, for example through an administrator-reviewed install -m 600 process.

Avoid interactive secret entry in recorded agent or terminal sessions.

Disable editor backup and swap files when handling secrets.

Test service access after migration and securely remove superseded plaintext credentials.

Rotate every migrated credential and review its access logs.

other

Warning

Location: references/data-classification.md:44
Finding: Hardcoded Tenant Telemetry and Operational Data Contaminate Reusable Assessments
Content: View full analysis
Vulnerability Details

File Location: references/data-classification.md:44-57; references/finserv-regulations.md:77-78; references/training-requirements.md:72-80; references/ai-inventory.md:34-45
Vulnerability Type: other: Hardcoded tenant data and assessment contamination
Risk Level: Medium

Vulnerable Code Snippets:

references/data-classification.md:44-57

text
## fi.com Specific Guidance Based on current webhook_events data, the following are **actively being entered** into Perplexity and ChatGPT and must be addressed immediately: | Detected Input Type | Current Status | Required Action | |---|---|---| | Financial data / reports | 🔴 Being entered, 100% blocked | DLP working — enforce AUP, gate with training | | Investment strategies | 🔴 Being entered, 100% blocked | Escalate to Legal/Compliance — potential MNPI | | Investment decisions | 🔴 Being entered, 100% blocked | Escalate to Legal/Compliance — potential MNPI | | Internal communications | 🟡 Being entered, partially blocked | Strengthen DLP rules | | Network infrastructure | 🟡 Being entered, partially blocked | Security risk — tighten DLP | | Source code | 🔴 New this week, not fully blocked | Update DLP rules immediately | | Credentials/passwords | 🔴 Being entered, some blocked | Credential rotation + DLP tightening | | GitHub tokens | 🔴 New this week | Immediate credential rotation required |

references/finserv-regulations.md:77-78

text
**Current exposure at fi.com:** Based on webhook_events data, 3,365 financial data events and 1,384 investment strategy events have been detected entering third-party AI tools. Legal and Compliance must be briefed immediately.

references/training-requirements.md:72-80

text
Current fi.com status (from training_completions vs webhook_events): - **Total users with AI access:** 289 - **Trained:** 31 (11%) ✅ - **Untrained:** 258 (89%) 🚨 **Priority groups ...[truncated 3297 chars]
Remediation: View remediation
Remediation Suggestions

Remove all tenant-specific telemetry and inventory data from distributable Skill references.

Store customer evidence in a separate, access-controlled data source rather than in reusable instructions.

Replace organization names, event counts, identities, and statuses with conspicuous placeholders such as [EXAMPLE ORGANIZATION], [VALIDATED EVENT COUNT], and [SYSTEM OWNER].

If examples are needed, label them explicitly as fictional and prevent them from being treated as assessment evidence.

Require source provenance, collection time, tenant identity, and user confirmation before describing telemetry as current.

Add an instruction that embedded examples must never be attributed to the organization being assessed.

Add automated linting to detect organization domains, personal names, internal table names, hardcoded statistics, and phrases such as “current state” or “current exposure.”

Review existing distributions to determine whether the embedded tenant information requires removal or notification.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The playbook recommends a 'quick option' of storing credentials in /etc/openclaw/secrets.env, which normalizes plaintext secret storage on disk. Even with restrictive permissions, disk-resident secrets are vulnerable to host compromise, accidental inclusion in backups, misconfiguration, debugging leaks, or unauthorized local access, and this is more dangerous because the document is a remediation guide likely to be followed operationally.
Content: Scanner excerpt · references/remediation-playbooks.md (reported line 117)May include surrounding context.
md
2. Move credentials to a secrets manager: - Linux: use environment variables sourced from a secured `.env` file (chmod 600) - Better: HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault - Quick option: store in `/etc/openclaw/secrets.env` with strict permissions, source at runtime 3. Rotate all credentials that were stored in plaintext — assume exposed 4. Implement secret scanning in CI/CD pipeline (e.g., GitGuardian, truffleHog) 5. Add pre-commit hook to catch secrets before they're committed

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The command to edit /etc/openclaw/secrets.env directly instructs operators to create and populate a plaintext file containing secrets. This is dangerous because it turns sensitive credentials into manually managed filesystem artifacts, increasing the chance of disclosure through backups, shell history/process observation during handling, endpoint compromise, or operational mistakes.
Content: Scanner excerpt · references/remediation-playbooks.md (reported line 127)May include surrounding context.
bash
# Create secured env file sudo mkdir -p /etc/openclaw sudo nano /etc/openclaw/secrets.env # Add: DB_PASS=... SMTP_PASS=... sudo chmod 600 /etc/openclaw/secrets.env sudo chown bcaddy:bcaddy /etc/openclaw/secrets.env

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: Although chmod 600 is protective, its use here is part of a workflow that endorses storing credentials in secrets.env. Tight permissions do not eliminate the underlying risk of plaintext secret storage and may create false confidence that the approach is fully safe.
Content: Scanner excerpt · references/remediation-playbooks.md (reported line 129)May include surrounding context.
sudo mkdir -p /etc/openclaw sudo nano /etc/openclaw/secrets.env

Add: DB_PASS=... SMTP_PASS=...

sudo chmod 600 /etc/openclaw/secrets.env sudo chown bcaddy:bcaddy /etc/openclaw/secrets.env

text

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: Assigning ownership of secrets.env to an application account enables that account to read plaintext credentials from disk, so compromise of the service user can directly expose the secrets. In this remediation context, the document increases operational risk by prescribing a persistent credential file rather than a more secure retrieval mechanism.
Content: Scanner excerpt · references/remediation-playbooks.md (reported line 130)May include surrounding context.
sudo nano /etc/openclaw/secrets.env

Add: DB_PASS=... SMTP_PASS=...

sudo chmod 600 /etc/openclaw/secrets.env sudo chown bcaddy:bcaddy /etc/openclaw/secrets.env

text
---

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger condition is broad enough to activate on nearly any request involving AI regulatory or risk evaluation, which can cause the skill to run outside its intended scope. Over-broad activation increases the chance of inappropriate interception, misleading compliance guidance, or unnecessary access to potentially sensitive business context supplied in general-purpose conversations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The reference file includes a specific organization name and concrete exposure counts derived from purported webhook event data, which goes beyond generic compliance guidance and introduces sensitive, potentially confidential incident intelligence into a reusable skill artifact. In a compliance skill, this is especially dangerous because users may trust and propagate the claim as verified internal fact, causing unauthorized disclosure, reputational harm, or inappropriate escalation based on embedded tenant-specific data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file presents sensitive-seeming incident metrics and an instruction to brief Legal and Compliance immediately without any caveat that the data may be illustrative, unverified, or require authorized handling. In the context of a compliance-analysis skill, this can trigger unnecessary or misdirected incident response, leak sensitive business context to unauthorized users, and blur the boundary between general regulatory guidance and live internal investigative findings.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/incident-response.md (reported line 70)May include surrounding context.
md
### Examples - AI-generated report contains factual errors acted upon by business - AI recommendation discriminates against protected class - AI legal/financial advice acted upon without verification - AI-generated content published that violates law/policy ### Response

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/other-frameworks.md (reported line 22)May include surrounding context.
md
**Key obligations for AI:** - Lawful basis for processing (Article 6) - Data minimization — only use data necessary for the purpose - Purpose limitation — don't reuse data for other AI training without consent - Right to explanation for automated decisions (Article 22) - DPIA (Data Protection Impact Assessment) required for high-risk processing - Privacy by design and by default

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/remediation-playbooks.md (reported line 115)May include surrounding context.
md
**Steps:** 1. Audit all config files, cron job payloads, and environment files for plaintext credentials 2. Move credentials to a secrets manager: - Linux: use environment variables sourced from a secured `.env` file (chmod 600) - Better: HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault - Quick option: store in `/etc/openclaw/secrets.env` with strict permissions, source at runtime 3. Rotate all credentials that were stored in plaintext — assume exposed

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/remediation-playbooks.md (reported line 126)May include surrounding context.
Quick fix for OpenClaw specifically:

bash
# Create secured env file sudo mkdir -p /etc/openclaw sudo nano /etc/openclaw/secrets.env # Add: DB_PASS=... SMTP_PASS=... sudo chmod 600 /etc/openclaw/secrets.env

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/remediation-playbooks.md (reported line 127)May include surrounding context.
Quick fix for OpenClaw specifically:

bash
# Create secured env file sudo mkdir -p /etc/openclaw sudo nano /etc/openclaw/secrets.env # Add: DB_PASS=... SMTP_PASS=... sudo chmod 600 /etc/openclaw/secrets.env

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/remediation-playbooks.md (reported line 129)May include surrounding context.
Quick fix for OpenClaw specifically:

bash
# Create secured env file sudo mkdir -p /etc/openclaw sudo nano /etc/openclaw/secrets.env # Add: DB_PASS=... SMTP_PASS=... sudo chmod 600 /etc/openclaw/secrets.env

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/remediation-playbooks.md (reported line 130)May include surrounding context.
Quick fix for OpenClaw specifically:

bash
# Create secured env file sudo mkdir -p /etc/openclaw sudo nano /etc/openclaw/secrets.env # Add: DB_PASS=... SMTP_PASS=... sudo chmod 600 /etc/openclaw/secrets.env

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/remediation-playbooks.md (reported line 129)May include surrounding context.
sudo mkdir -p /etc/openclaw sudo nano /etc/openclaw/secrets.env

Add: DB_PASS=... SMTP_PASS=...

sudo chmod 600 /etc/openclaw/secrets.env sudo chown bcaddy:bcaddy /etc/openclaw/secrets.env

text

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The phrase stating content must comply with "core socialist values" is a natural-language locale/policy constraint embedded in the document. Although presented as regulatory summary, it is not explicitly labeled on that line as a China-specific legal requirement, which could be misread as a general policy requirement outside that jurisdiction.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file begins with a broad description of 'Quick-action guides for the most common AI compliance gaps' but does not specify how or when a system should invoke or surface this skill versus other compliance content. In markdown skills, missing specificity around invocation scope can create ambiguous activation behavior if the file is used as a triggerable reference.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Remediation Suggestions

other

Vulnerability Details

Remediation Suggestions

SkillSpector

Credential Access

Credential Access

Credential Access

Add: DB_PASS=... SMTP_PASS=...

Credential Access

Add: DB_PASS=... SMTP_PASS=...

Vague Triggers

Description-Behavior Mismatch

Missing User Warnings

Autonomous Decision Making

Autonomous Decision Making

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Add: DB_PASS=... SMTP_PASS=...

Natural-Language Policy Violations

Vague Triggers