T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:73- Finding
Mutable Remote Installer Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Deploy Guide
Security checks for vulnerabilities and agentic risk
Overview
This deployment skill is mostly coherent, but it asks the agent to install mutable third-party software and create persistent automation with enough risk that users should review it carefully before use.
Install only if you are comfortable reviewing each command first. Prefer pinned versions or verified releases, avoid running curl-to-shell installers, use isolated environments for npm, Bun, and Python packages, confirm canonical target paths, and enable cron jobs or WeChat integration only after reviewing exactly what data they can read and modify.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:87- Finding
Unpinned Third-Party Packages, Plugins, Skills, and Repositories Are Installed
- Content
View full analysis
)" git clone https://github.com/OttoPrua/vid2md.git ``` ```bash cd pip3 install -r requirements.txt ``` ```bash pip3 install mlx-whisper ``` ```bash pip3 install faster-whisper ``` ```bash git clone https://github.com/OttoPrua/openclaw-wechat-bot.git "$PLUGIN_DIR" cd "$PLUGIN_DIR" npm install ``` ### Technical Analysis The commands install packages without exact versions and clone repositories without fixed commit hashes or signed tags. The audit artifact does not include the source or dependency manifests of these external components, so their behavior cannot be validated from the reviewed files. Package installation can execute lifecycle hooks, build scripts, setup logic, and native code. Installed OpenClaw plugins and skills may subsequently operate within the Agent environment. Cloning a repository's default branch also retrieves mutable content that can change independently of this Skill. Global installation of `qmd` further broadens the affected environment. Running `pip3 install` without a dedicated virtual environment may modify the user's general Python environment, while `npm install` may execute package lifecycle scripts from direct or transitive dependencies. ### Attack Path 1. An attacker compromises a package publisher, source repository, ClawHub entry, plugin account, or transitive dependency. 2. The attacker publishes a modified package or updates a mutable repository branch. 3. The deployment Skill installs the latest available content because ...[truncated 1183 chars]- Remediation
View remediation
T06 · System Persistence
Warning
- Location
SKILL.md:498- Finding
Persistent Scheduled Agents Read and Modify Memory and Project Data
- Content
View full analysis
" \ --session isolated \ --message "Run memory consolidation: scan memory/ root for dated session log files, refine each into a ≤30-line structured summary, move originals to memory/archive/YYYY-MM/, deduplicate patterns/." \ --announce ``` ```bash openclaw cron add \ --name "Daily Progress Sync" \ --cron "0 4 * * *" \ --tz "" \ --session isolated \ --message "Read blackboard/REGISTRY.md and yesterday's calendar events. Update Blackboard project cards with any progress changes." \ --announce ``` ```bash openclaw cron add \ --name "Monthly Session Cleanup" \ --cron "0 3 1 * *" \ --tz "" \ --session isolated \ --message "Archive memory/ root session log files (YYYY-MM-DD.md format) older than 7 days to memory/archive/YYYY-MM/. Create the archive folder if it does not exist." \ --announce ``` ### Technical Analysis These commands create scheduled jobs that survive the current Skill invocation and execute in future sessions. The jobs direct an Agent to read, summarize, update, deduplicate, archive, or move persistent records. The daily synchronization task additionally requests access to calendar events. The persistence is disclosed and the Skill asks which jobs to install, so this is not a concealed backdoor. Nevertheless, recurring execution carries continuing authority beyond the immediate deployment operation and is not necessary for installing components A through D. It should therefore be treated as a separate least-privilege decision. Natural-language cron messages also leave behavior dependent on future Agent interpretation and the content encountered at execution time. Poisoned or adversarial text in memory, Blac ...[truncated 1579 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:114- Finding
User-Controlled Paths Are Unsafely Interpolated into Shell Commands
- Content
View full analysis
/memory --pattern "**/*.md" # Blackboard collection qmd collection add blackboard /blackboard --pattern "**/*.md" ``` ```bash Ask: "Where should vid2md be installed? (default: `~/Projects/vid2md`)" Wait for answer, substitute as ``. ```bash # Check if already exists ls /vid2md.py 2>/dev/null && echo "already exists" ``` ```bash mkdir -p "$(dirname )" git clone https://github.com/OttoPrua/vid2md.git ``` ```bash cd pip3 install -r requirements.txt ``` ### Technical Analysis The Skill asks the user for workspace and installation paths and then instructs the Agent to substitute those values directly into shell command templates. The placeholders are not consistently enclosed in shell-safe quotes. A path containing whitespace will be split into multiple arguments. A path beginning with `-` may be interpreted as an option by some commands. More seriously, shell metacharacters such as semicolons, command substitutions, redirects, or newlines can change command structure if the Agent performs literal textual substitution. The expression below is particularly unsafe: ```bash mkdir -p "$(dirname )" ``` Although the outer command substitution is quoted, the substituted value is inserted into shell syntax inside `$(...)`. Quoting the output of `dirname` does not make the input safe. A malicious value can terminate or alter the inner command. ### Attack Path 1. The Skill asks for `` or ``. 2. An attacker supplies a crafted value directly, through copied deployment instructions, or through another untrusted conversational source. 3. The Agent substitutes the value into the documented she ...[truncated 1122 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The command 'curl -fsSL https://bun.sh/install | bash' executes code fetched from the network immediately in the shell. This is a classic high-risk pattern because any compromise of the remote source or transport path results in arbitrary code execution with the user's privileges.
- Content
md - `brew`: https://brew.sh - `ffmpeg`: `brew install ffmpeg` - `ollama`: https://ollama.com - `bun`: `curl -fsSL https://bun.sh/install | bash` ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README promotes a skill that installs software, edits local configuration, clones repositories, and adds cron jobs, but it does not clearly warn users that running it will modify their local environment and create persistent scheduled tasks. In an agent-executed deployment context, that omission increases the risk of users authorizing impactful actions without informed consent, especially because the README frames the process as a guided convenience feature.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README advertises automated installation, component setup, verification, and progression across deployment phases, but does not prominently warn that the skill will modify the local system, install software, change configuration, clone repositories, and add scheduled tasks. In a deployment skill, omission of an explicit impact warning can lead users to authorize execution without understanding the persistence and breadth of changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README suggests invoking the skill with a very broad natural-language request ('帮我部署 OpenClaw 本地能力'), which can cause accidental triggering in contexts where the user is only asking for information or planning help. Because this skill performs dependency checks, installation, configuration changes, and cron setup, ambiguous activation increases the chance of unintended system modification.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 88% confidence
- Finding
The trigger 'deploy openclaw' overlaps with a built-in 'deploy' command namespace and can create ambiguous routing. Trigger shadowing is dangerous because users may invoke this skill when they intended a safer or more constrained built-in operation, leading to unintended installation and configuration actions.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 94% confidence
- Finding
The trigger 'install capabilities' is highly generic and collides with the common built-in 'install' command space. In this skill's context, accidental activation is more dangerous because the instructions include package installs, plugin deployment, cron registration, and persistent config changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger set includes broad phrases like 'setup openclaw' and 'install capabilities', which can match general deployment requests and cause this skill to activate unexpectedly. Because the skill contains installation, configuration, and persistence steps, accidental invocation increases the chance of unreviewed system changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill recommends a network-piped installer command for bun without any integrity, provenance, or review warning. Piping remote content directly into a shell is dangerous because compromise of the upstream host, CDN, or network path can lead to arbitrary code execution on the user's machine.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
qmd status
text ### A2: Create memory collections Ask the user for their workspace path: > "What is your OpenClaw workspace path? (default: `~/.openclaw/workspace`)"
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash # Check if already installed ls ~/.openclaw/workspace/skills/memory-manager/SKILL.md 2>/dev/null && echo "already installed"If not installed:
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash # Check if already installed ls ~/.openclaw/workspace/skills/memory-manager/SKILL.md 2>/dev/null && echo "already installed"If not installed:
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
ls ~/.openclaw/workspace/memory/ 2>/dev/null | head -10
text If `MEMORY.md` or `memory/` doesn't exist, create the skeleton: ```bash mkdir -p ~/.openclaw/workspace/memory/user/preferences mkdir -p ~/.openclaw/workspace/memory/user/entities
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Appending an environment variable export to ~/.zshrc creates persistent shell configuration changes. Persistence mechanisms are security-relevant because they survive the current session, can affect future command execution, and may be abused if the inserted value is incorrect or attacker-controlled.
- Content
If yes, ask for the path and set:
bash export WECHAT_OCR_BIN=/path/to/wechat-ocr # Add to ~/.zshrc or ~/.bashrc: echo 'export WECHAT_OCR_BIN=/path/to/wechat-ocr' >> ~/.zshrc
Static analysis
No suspicious patterns detected.