OpenClaw Safe Upgrade Rehearsal Kit

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:15 AM UTC
• Version: 1.3.2

Overview

This skill is a dry-run OpenClaw upgrade checker that downloads package evidence and writes local reports, with no evidence of live updates or data exfiltration.

Install only if you want a local dry-run upgrade evidence workflow. Expect it to call npm against the public registry, download package archives, inspect operator-specified package and observation files, and write reports/cache files. Do not provide secrets or production logs, use exact versions and fresh output directories, and only use the benchmark advisory adapter with a local command you fully trust. Treat any ready result as planning input, not approval to update production.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description frames the skill as upgrade rehearsal tooling used before an OpenClaw upgrade to analyze package evidence, installation coverage, and Kova reports for migration and rollback planning. The supplied code instead implements openclaw_benchmark.py, which is explicitly a benchmark runner and reporting tool. Its primary functions are corpus verification, deterministic and advisory benchmark arm execution, scoring against frozen labels, threshold aggregation, and writing evaluation artifacts. The module repeatedly states it is evaluation-only, non-authoritative, and separate from canonical verdict/application paths. There is no substantive behavior for preparing an upgrade plan, rollback plan, or post-start verification plan, nor any clear handling of Kova reports. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description says the skill should rehearse an OpenClaw update and use package evidence, installation coverage, and Kova reports to identify compatibility gaps and prepare migration/rollback/post-start verification plans. The code instead reads precomputed artifacts such as verdict.json, impact-shadow.json, and an optional shadow-runs index, then renders a markdown summary for operators. It lists evidence statuses and file availability, summarizes gate decisions and optional shadow observations, and includes repository/run links. The script is explicitly framed as a 'non-authoritative operator view' and even states that preflight does not prove migration, rollback, or post-activation behavior. This is a materially different primary purpose from performing an update rehearsal or planning exercise, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/phase-handoffs.md (reported line 41)May include surrounding context.

md

2. Migration/restore rehearsal consumes the same `candidate_root` and emits
   disposable evidence. It cannot activate the candidate.
3. Activation planning records an external approval requirement and keeps live
   E2E `not_run`. The safe-update skill stops here.
4. After a separately controlled activation, an operational capability may
   create a forward-reconcile handoff. That capability owns its approval,
   rollback, and containment semantics.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill for rehearsing an OpenClaw update to identify compatibility gaps and prepare migration, rollback, and post-start verification plans. This file instead implements a benchmark harness that loads a frozen corpus, scores fixtures, aggregates metrics, and emits benchmark scorecards, reports, and a shadow-run index for evaluation-only purposes, which is materially different from performing an update rehearsal.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/openclaw_benchmark.py (reported line 95)May include surrounding context.

python

,
    "LANG",
    "LC_ALL",
    "NODE_EXTRA_CA_CERTS",
    "NO_PROXY",
    "PATH",
    "PATHEXT",
    "SSL_CERT_DIR",
    "SSL_CERT_FILE",
    "SYSTEMROOT",
    "TEMP",
    "TMP",
    "TMPDIR",
    "USERPROFILE",
    "all_proxy",
    "http_proxy",
    "https_proxy",
    "no_proxy",
)

# Deterministic arms run as fixed deterministic identities; they never
# inherit the operator-supplied (advisory) model family.
DETERMINISTIC_WORKER_ID = "openclaw-benchmark-deterministic"
DETERMINISTIC_MODEL_FAMILY = "deterministic"

# Authority-bearing keys the advisory worker has no right to emit. Their
# presence (in the runner envelope or the raw result) is a blocked-verdict
# signal: the worker tried to assert a canonical block it cannot own. This
# is distinct from a false-unaffected claim and never weakens the #15
# result schema, which the worker output must still satisfy.
BLOCKED_VERDICT_KEYS = frozenset(
    {
        "verdict",
        "block",
        "blocked",
        "decision",
        "d

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The benchmark runner invokes an externally configured advisory adapter subprocess, which extends behavior beyond passive rehearsal/reporting into execution of external code. In a skill context, this is more dangerous because users may expect analysis-only behavior from an update-rehearsal tool, but the feature permits arbitrary command execution if configuration is influenced by an attacker or careless operator.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/openclaw_safe_update.py (reported line 885)May include surrounding context.

python

except OSError as exc:
        raise RehearsalError("cannot create isolated npm cache") from exc
    execution_dir = working_dir or cache_dir
    project_config = execution_dir / ".npmrc"
    try:
        if project_config.exists() and project_config.read_bytes():
            raise RehearsalError(

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/openclaw_safe_update.py (reported line 889)May include surrounding context.

python

except OSError as exc:
        raise RehearsalError("cannot create isolated npm cache") from exc
    execution_dir = working_dir or cache_dir
    project_config = execution_dir / ".npmrc"
    try:
        if project_config.exists() and project_config.read_bytes():
            raise RehearsalError(

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/openclaw_safe_update.py (reported line 894)May include surrounding context.

python

except OSError as exc:
        raise RehearsalError("cannot create isolated npm cache") from exc
    execution_dir = working_dir or cache_dir
    project_config = execution_dir / ".npmrc"
    try:
        if project_config.exists() and project_config.read_bytes():
            raise RehearsalError(

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/openclaw_safe_update.py (reported line 895)May include surrounding context.

python

except OSError as exc:
        raise RehearsalError("cannot create isolated npm cache") from exc
    execution_dir = working_dir or cache_dir
    project_config = execution_dir / ".npmrc"
    try:
        if project_config.exists() and project_config.read_bytes():
            raise RehearsalError(

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes Python and npm-based commands with file, network, environment, and shell effects but does not declare any explicit tool scope or allowed-tools boundary. That increases the chance an agent runtime will execute the workflow with broader privileges than operators expect, especially since the documented flow writes artifacts, queries npm, downloads packages, and inspects globally installed software.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

{
      "id": "mcporter-skill-contract",
      "kind": "member_contains",
      "member": "package/skills/mcporter/SKILL.md",
      "needle": "mcporter",
      "package": "openclaw"
    }

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · assets/customizations.example.json (reported line 18)May include surrounding context.

json

{
      "id": "mcporter-skill-contract",
      "kind": "member_contains",
      "member": "package/skills/mcporter/SKILL.md",
      "needle": "mcporter",
      "package": "openclaw"
    }

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The advisory section says the adapter receives the prompt_payload JSON on stdin and that the runner never sends additional material to it. Later CLI documentation states the runner pipes the full openclaw.safe_update.advisory_input.v1 envelope to stdin, which is a broader object than prompt_payload. These statements actively contradict each other about the actual adapter input boundary.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 92% confidence

Finding

The code executes an operator-configured external command via subprocess.run, which creates a trust boundary crossing and allows arbitrary local code execution under the runner's privileges. Although shell=False, shlex splitting, PATH resolution, timeout, output-size limits, and restricted environment reduce classic command-injection risk, a malicious or mistaken adapter command still results in execution of untrusted binaries and possible data exfiltration through the passed advisory input and allowed environment variables.

Content

Scanner excerpt · scripts/openclaw_benchmark.py (reported line 916)May include surrounding context.

python

raise BenchmarkError("adapter command not found")
    argv[0] = executable
    try:
        completed = subprocess.run(
            argv,
            shell=False,
            input=json.dumps(advisory_input, ensure_ascii=True),

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/openclaw_safe_update.py (reported line 738)May include surrounding context.

python

def detect_node_version() -> str:
    try:
        completed = subprocess.run(
            [resolve_runtime_command("node"), "--version"],
            check=True,
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 77% confidence

Finding

The code executes npm with argument lists partly derived from user input (arguments) and inherited environment variables including PATH, proxy settings, and certificate-related variables. Although it disables scripts and avoids shell=True, invoking an external package manager against remote registry content can still expose the host to PATH hijacking, trust-boundary issues, or unexpected npm/network behavior in a supposedly read-only rehearsal tool.

Content

Scanner excerpt · scripts/openclaw_safe_update.py (reported line 918)May include surrounding context.

python

}
    )
    try:
        completed = subprocess.run(
            [resolve_runtime_command("npm"), *arguments],
            cwd=execution_dir,
            check=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/openclaw_safe_update.py (reported line 941)May include surrounding context.

python

def command_version(command: str) -> str:
    try:
        completed = subprocess.run(
            [resolve_runtime_command(command), "--version"],
            check=True,
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

This subprocess call executes a command array that may be fully replaced by the command_override parameter. If untrusted code or plugins can influence that parameter, the function becomes a generic arbitrary command execution primitive despite the tool's read-only safety claims.

Content

Scanner excerpt · scripts/openclaw_safe_update.py (reported line 1658)May include surrounding context.

python

if command_override is None and cache_dir is not None:
        command.extend(["--cache-dir", str(cache_dir)])
    try:
        completed = subprocess.run(
            command,
            check=False,
            capture_output=True,

Static analysis

No suspicious patterns detected.