Security audit

fnOS OpenClaw Updater

Security checks for vulnerabilities and agentic risk

Overview

This skill is an updater whose main behavior is disclosed, but it tells an agent to overwrite the active OpenClaw gateway from a mutable npm package without enough user confirmation, rollback, or supply-chain controls.

Review this before installing if the OpenClaw gateway is important to you. Only run the update after confirming the target version and package source, and consider backing up or staging the managed install first; avoid changing npm's global registry unless you intend that setting to affect later npm commands too.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:27
Finding: Unverified npm Package Installation and Persistent Third-Party Registry Configuration
Content: View full analysis
``` ```bash cd "$OPENCLAW_DATA_DIR/openclaw" && npm install openclaw@ ``` ```bash # A mirror may be configured when npm downloads are slow npm config set registry https://registry.npmmirror.com ``` ### Technical Analysis The Skill obtains the latest version from an npm registry and immediately instructs the Agent to install it. It does not require verification of package provenance, cryptographic integrity, publisher identity, lockfile contents, or an approved version before installation. An npm installation can execute package lifecycle scripts and place executable JavaScript in the managed OpenClaw installation. Consequently, compromise of the package publisher, registry, mirror, or dependency chain could result in attacker-controlled code running with the permissions of the user invoking the Skill. The suggested `npm config set registry` command persistently changes npm's configured registry rather than limiting the alternate source to the current command. This expands the trust boundary beyond the OpenClaw update: subsequent npm operations may also retrieve packages and metadata from that mirror. The instruction does not provide integrity or provenance controls that compensate for this additional supply-chain exposure. The update operation is consistent with the declared purpose of the Skill, and no evidence shows that the package or mirror is currently malicious. The vulnerability is the absence of controls necessary to safely retrieve and install ...[truncated 1892 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill performs an in-place npm install over the active OpenClaw installation and states that the gateway will automatically run the new version, but it does not require explicit confirmation, describe service-impacting behavior, or provide rollback guidance. This creates operational and security risk because an update can unexpectedly change runtime behavior, break compatibility, or pull a compromised or faulty package version directly into a running gateway environment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.