Security audit

Oc

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent OpenClaw troubleshooting skill, but it includes unsafe setup and repair paths that can expose credentials, weaken host security, or install mutable software.

Review this skill before installing. Use diagnostic/read-only commands first, avoid the setup wizard until credential storage and gateway defaults are fixed, do not follow Docker socket chmod guidance, and require explicit approval for package installs, Docker pulls, remote installer scripts, log deletion, or cache updates.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/installation-errors.md:32
Finding: Remote installation scripts are executed directly without integrity verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/lib/setup_helpers.py:31
Finding: Setup wizard persists provider API keys in plaintext configuration files and backups
Content: View full analysis
dict: """Generate openclaw.json configuration.""" config = { "gateway": { "port": 18789, "bind": "0.0.0.0", "authMode": "token", "authToken": f"changeme-{hash(ai_config['api_key']) % 100000000:08d}" }, "agent": { "model": ai_config["model"], "provider": ai_config["provider"], "workspace": str(Path.home() / "openclaw-workspace"), "sandboxMode": "relaxed" }, "channels": {}, "skills": {}, "plugins": [] } config["agent"][f"{ai_config['provider']}_api_key"] = ai_config["api_key"] ``` The resulting configuration and backup are written as follows: ```python def save_config_with_backup(config: dict) -> bool: """Save config with backup of existing.""" if CONFIG_FILE.exists(): backup_file = CONFIG_FILE.with_suffix(".json.backup") try: import shutil shutil.copy2(CONFIG_FILE, backup_file) except Exception: pass return save_json(CONFIG_FILE, config) ``` ```python def save_json(path: Path, data: dict) -> bool: try: path.parent.mkdir(parents=True, exist_ok=True) with open(path, 'w', encoding='utf-8') as f: json.dump(data, f, indent=2) return True ``` ### Technical Analysis The setup wizard masks the API key while it is entered, but terminal masking does not protect the key after collection. `generate_config()` inserts the complete provider API key directly into the ordinary `openclaw.json` configuration object. The generic `save_json()` function creates the file usin ...[truncated 1400 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/lib/setup_helpers.py:31
Finding: Public gateway configuration uses a weak token derived from the provider API key
Content: View full analysis
dict: """Generate openclaw.json configuration.""" config = { "gateway": { "port": 18789, "bind": "0.0.0.0", "authMode": "token", "authToken": f"changeme-{hash(ai_config['api_key']) % 100000000:08d}" }, ``` The corresponding security check only detects one exact token: ```python auth_token = gateway.get("authToken") if auth_token == "changeme": issues.append(ConfigIssue( severity="error", path="gateway.authToken", message="Using default auth token 'changeme'", fix_hint="Generate a secure random token for production use" )) ``` ### Technical Analysis The wizard binds the gateway to `0.0.0.0`, exposing it on every available network interface. It then generates an authentication token from Python's non-cryptographic `hash()` function and truncates the result to 100,000,000 possibilities. This provides at most approximately 27 bits of token space and does not constitute a cryptographically secure token-generation mechanism. The token also unnecessarily derives authentication material from the provider API key instead of using independent randomness. The security analyzer does not recognize generated values beginning with `changeme-` as weak because it only rejects the exact string `changeme`. ### Attack Path 1. A user runs the setup wizard with its default configuration. 2. The gateway is bound to every network interface. 3. The generated gateway token has only eight decimal digits following a known prefix. 4. A network attacker locates port 18789 through local discovery or scanning. 5. The attacker repeatedly tests ca ...[truncated 766 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/sandbox-errors.md:45
Finding: Documentation recommends making the Docker control socket world-writable
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: references/sandbox-errors.md:38
Finding: Troubleshooting instructions enable Docker as a persistent boot service
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/channel-errors.md:310
Finding: Signal CLI executable archive is installed without checksum or signature verification
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: data/fix-recipes.json:227
Finding: Automatic fixes install mutable global packages and Docker images
Content: View full analysis
=8.1.0 rich>=13.0.0 requests>=2.31.0 beautifulsoup4>=4.12.0 ``` ### Technical Analysis The `latest` Docker tag is mutable and does not identify immutable image content. Global npm installation without an exact version similarly resolves to whatever the registry currently considers current. The Python installation command ignores even the lower bounds in `requirements.txt`, and no lockfile or hash verification is present. Package installers and container images can run or contain attacker-controlled code. Classifying these operations as `safe_auto` means a diagnostic invocation can cross into software installation without a dedicated supply-chain approval boundary. The issue does not establish that the named packages are presently malicious. The vulnerability is that future or compromised registry content can change the effective code after the Skill has been reviewed. ### Attack Path 1. An attacker compromise ...[truncated 1045 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (243)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The combination of undeclared update-checking and auto-detection/recommendation behavior with absent or overstated diagnostics indicates incomplete and misleading disclosure. Even if not overtly malicious, this weakens user consent and complicates security review because the real operational footprint differs from the advertised one.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The combination of undeclared update-checking and auto-detection/recommendation behavior with absent or overstated diagnostics indicates incomplete and misleading disclosure. Even if not overtly malicious, this weakens user consent and complicates security review because the real operational footprint differs from the advertised one.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The combination of undeclared update-checking and auto-detection/recommendation behavior with absent or overstated diagnostics indicates incomplete and misleading disclosure. Even if not overtly malicious, this weakens user consent and complicates security review because the real operational footprint differs from the advertised one.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The combination of undeclared update-checking and auto-detection/recommendation behavior with absent or overstated diagnostics indicates incomplete and misleading disclosure. Even if not overtly malicious, this weakens user consent and complicates security review because the real operational footprint differs from the advertised one.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The combination of undeclared update-checking and auto-detection/recommendation behavior with absent or overstated diagnostics indicates incomplete and misleading disclosure. Even if not overtly malicious, this weakens user consent and complicates security review because the real operational footprint differs from the advertised one.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The combination of undeclared update-checking and auto-detection/recommendation behavior with absent or overstated diagnostics indicates incomplete and misleading disclosure. Even if not overtly malicious, this weakens user consent and complicates security review because the real operational footprint differs from the advertised one.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The combination of undeclared update-checking and auto-detection/recommendation behavior with absent or overstated diagnostics indicates incomplete and misleading disclosure. Even if not overtly malicious, this weakens user consent and complicates security review because the real operational footprint differs from the advertised one.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The combination of undeclared update-checking and auto-detection/recommendation behavior with absent or overstated diagnostics indicates incomplete and misleading disclosure. Even if not overtly malicious, this weakens user consent and complicates security review because the real operational footprint differs from the advertised one.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The combination of undeclared update-checking and auto-detection/recommendation behavior with absent or overstated diagnostics indicates incomplete and misleading disclosure. Even if not overtly malicious, this weakens user consent and complicates security review because the real operational footprint differs from the advertised one.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The combination of undeclared update-checking and auto-detection/recommendation behavior with absent or overstated diagnostics indicates incomplete and misleading disclosure. Even if not overtly malicious, this weakens user consent and complicates security review because the real operational footprint differs from the advertised one.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The combination of undeclared update-checking and auto-detection/recommendation behavior with absent or overstated diagnostics indicates incomplete and misleading disclosure. Even if not overtly malicious, this weakens user consent and complicates security review because the real operational footprint differs from the advertised one.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The combination of undeclared update-checking and auto-detection/recommendation behavior with absent or overstated diagnostics indicates incomplete and misleading disclosure. Even if not overtly malicious, this weakens user consent and complicates security review because the real operational footprint differs from the advertised one.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The combination of undeclared update-checking and auto-detection/recommendation behavior with absent or overstated diagnostics indicates incomplete and misleading disclosure. Even if not overtly malicious, this weakens user consent and complicates security review because the real operational footprint differs from the advertised one.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 93% confidence
Finding: A self-updater is a genuine self-modification capability: it can change the skill's local references or cached state after deployment. Even if intended for maintenance, self-modifying behavior increases supply-chain and integrity risk because future behavior may differ from what was originally reviewed.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
python3 {baseDir}/scripts/enhanced-doctor.py --json

text
### Self-Updater Keep references and caches current. ```bash # Check what's outdated

Self-Modification

High

Category: Rogue Agent
Confidence: 95% confidence
Finding: The '--update' command is a direct mutating action that can alter local data under control of the skill. In security-sensitive environments, any self-update path is dangerous unless tightly scoped and transparently controlled, because it can introduce unreviewed content or drift from the audited version.
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
Keep references and caches current.

bash
# Check what's outdated python3 {baseDir}/scripts/self-updater.py --check # Update everything python3 {baseDir}/scripts/self-updater.py --update

Self-Modification

High

Category: Rogue Agent
Confidence: 95% confidence
Finding: Updating the skill cache is still a self-modification pathway because it changes local reference material that may influence future outputs or recommendations. This is especially risky if the cache contents are sourced remotely or later trusted without verification.
Content: Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.
md
python3 {baseDir}/scripts/self-updater.py --check # Update everything python3 {baseDir}/scripts/self-updater.py --update # Update only skill cache python3 {baseDir}/scripts/self-updater.py --update --skills-only

Self-Modification

High

Category: Rogue Agent
Confidence: 92% confidence
Finding: Documenting self-update-related commands without safeguards indicates a real integrity concern, even if the apparent goal is maintenance rather than exploitation. In this skill context, the danger is elevated because the same tool presents itself as a trusted 'doctor' utility, making users more likely to run mutating commands without scrutiny.
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
python3 {baseDir}/scripts/self-updater.py --update

Update only skill cache

python3 {baseDir}/scripts/self-updater.py --update --skills-only

text
### Setup Wizard

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: Advising users to add API keys to a .env file can increase credential exposure if the file is committed, copied, or left with weak permissions. In a diagnostic skill centered on fixing auth issues, normalizing local plaintext secret storage is risky unless accompanied by explicit safeguards and safer secret-management options.
Content: Scanner excerpt · data/error-patterns.json (reported line 27)May include surrounding context.
json
"title": "Missing Anthropic API Key", "description": "ANTHROPIC_API_KEY environment variable is not set", "causes": ["Environment variable not set", "API key not configured in openclaw.json", "Wrong environment file loaded"], "fix_steps": ["Set ANTHROPIC_API_KEY environment variable", "Add key to .env file", "Run: openclaw models auth setup-token --provider anthropic"], "fix_recipe_id": "fix-auth-env", "related_codes": ["INVALID_REQUEST"], "doc_url": "https://docs.openclaw.ai/providers/anthropic"

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: This repeats the same risky pattern for OpenAI credentials by recommending storage in a .env file. Because this file is only documentation/config data, it is not credential theft by itself, but it still encourages a storage practice that can lead to accidental secret disclosure in real deployments.
Content: Scanner excerpt · data/error-patterns.json (reported line 41)May include surrounding context.
json
"title": "Missing OpenAI API Key", "description": "OPENAI_API_KEY environment variable is not set", "causes": ["Environment variable not set", "API key not configured in openclaw.json", "Wrong environment file loaded"], "fix_steps": ["Set OPENAI_API_KEY environment variable", "Add key to .env file", "Run: openclaw models auth setup-token --provider openai"], "fix_recipe_id": "fix-auth-env", "related_codes": ["INVALID_REQUEST"], "doc_url": "https://docs.openclaw.ai/providers/openai"

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · data/error-patterns.json (reported line 769)May include surrounding context.
json
"title": "Context Window Exceeded", "description": "Request exceeds model's context window limit", "causes": ["Too many tokens in prompt", "Large conversation history", "Big file attachment", "Context accumulation"], "fix_steps": ["Reduce prompt length", "Clear conversation history", "Use model with larger context window", "Implement context pruning"], "fix_recipe_id": "fix-config-validate", "related_codes": ["PAYLOAD_TOO_LARGE"], "doc_url": "https://docs.openclaw.ai/models/context-limits"

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill can terminate arbitrary processes on a port using forceful kill commands, including 'kill -9', which can interrupt unrelated applications and cause data loss. For a diagnostic tool, this is unusually destructive because it converts troubleshooting into direct process control without strong safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This cleanup recipe permanently deletes logs and prunes Docker resources without an explicit warning, making accidental destructive execution more likely. Loss of logs can impede debugging and incident response, while Docker pruning may remove resources other workloads depend on.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · data/fix-recipes.json (reported line 32)May include surrounding context.
json
- Gateway rejects AI provider requests **Common Causes:** - Missing API key in .env file - Incorrect API key value - API key not activated with provider - Typo in environment variable name

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · data/fix-recipes.json (reported line 33)May include surrounding context.
json
- Gateway rejects AI provider requests **Common Causes:** - Missing API key in .env file - Incorrect API key value - API key not activated with provider - Typo in environment variable name

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/authentication-errors.md (reported line 15)May include surrounding context.
md
- Gateway rejects AI provider requests **Common Causes:** - Missing API key in .env file - Incorrect API key value - API key not activated with provider - Typo in environment variable name

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: references/installation-errors.md:517

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: references/troubleshooting-workflow.md:354

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T06 · System Persistence

T08 · Insecure Dependencies

T08 · Insecure Dependencies

SkillSpector

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Update only skill cache

Credential Access

Credential Access

Memory Manipulation

Context-Inappropriate Capability

Missing User Warnings

Credential Access

Credential Access

Credential Access

Static analysis

Documentation contains a destructive delete command without an explicit confirmation gate.

Documentation contains a destructive delete command without an explicit confirmation gate.