OpenClaw Shield

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:46 PM UTC
• Version: 1.0.3

Overview

The skill presents a coherent security-scanner purpose, but it tells users to clone and run unaudited, unpinned code from an external repository and suggests persistent scanning setup.

Install only if you are comfortable auditing or pinning the external repository yourself. Prefer a specific commit or signed release, run the scanner with read-only access limited to intended directories, and review any cron, Telegram alerting, and runtime guard configuration before enabling deployment features.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:27

Finding

Unpinned Remote Repository Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:27-32
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash

## Installation

```bash
cd /home/node/.openclaw/workspace
git clone https://github.com/pfaria32/OpenClaw-Shield-Security.git projects/OpenClaw-Shield

# Test the scanner
python3 projects/OpenClaw-Shield/src/scanner.py /path/to/scan

text

### Technical Analysis

The installation instructions clone the default branch of an external Git repository and then execute a Python file obtained from that repository. No immutable commit identifier, verified release artifact, cryptographic signature, or expected file hash is specified.

Consequently, the code executed by users can differ from the code that existed when this Skill was reviewed. The external repository's contents are not included in the audited artifact, so its claims of using only the Python standard library and making no network calls cannot be independently verified from this package.

This behavior is best classified as remote payload retrieval and execution rather than ordinary dependency installation: the instructions directly execute a remotely controlled source file after retrieval.

### Attack Path

1. An attacker compromises the upstream repository, its maintainer account, or another mechanism capable of changing its default branch.
2. The attacker modifies `src/scanner.py` or code imported by it to contain an arbitrary payload.
3. A user follows the Skill instructions and clones the mutable default branch.
4. The user executes `python3 projects/OpenClaw-Shield/src/scanner.py /path/to/scan`.
5. The modified payload runs with the invoking user's permissions and can access resources available to that user, including the selected scan target.

### Impact Assessment

Successful exploitation permits arbitrary Python code execution under the account running the scanner. The payload could read or modify f
...[truncated 677 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the reviewed scanner source directly in the Skill package so the executed implementation is part of the audited artifact.
2. If remote retrieval is necessary, pin the repository to a specific immutable commit hash rather than cloning and executing the default branch.
3. Publish and verify a cryptographic digest or signed release before executing any downloaded file.
4. Review the complete pinned source, including imported local modules and deployment scripts, before presenting it as safe.
5. Run the scanner under a dedicated, unprivileged account with read-only access limited to the intended scan target.
6. Apply file, process, and network sandboxing so the scanner cannot access unrelated credentials, execute unnecessary commands, or initiate unexpected outbound connections.
7. Avoid granting the scanner access to sensitive directories such as SSH and cloud credential stores unless scanning those locations is explicitly required and authorized.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.