Security audit

Openclaw Whisperer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate OpenClaw troubleshooting helper, but it includes under-scoped setup, credential, network-facing, package-install, and privilege-changing guidance that users should review carefully before installing.

Install only if you are comfortable reviewing and manually controlling setup and repair actions. Avoid running the remote curl-to-shell commands, do not make the Docker socket world-writable, change the generated gateway bind address/token before use, and store provider API keys with restrictive permissions or a secret manager.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/installation-errors.md:32
Finding: Remote Installation Scripts Are Executed Directly Without Integrity Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/lib/setup_helpers.py:28
Finding: Setup Wizard Stores Provider API Keys in Plaintext and Generates a Weak Network Gateway Token
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/sandbox-errors.md:38
Finding: Troubleshooting Guidance Grants Root-Equivalent Access Through the Docker Socket
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: references/channel-errors.md:310
Finding: Third-Party Executable Archive Is Installed Without Signature or Checksum Verification
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:16
Finding: Unpinned Dependencies and Automatic Global Package Installation Create Supply-Chain Risk
Content: View full analysis
=8.1.0 rich>=13.0.0 requests>=2.31.0 beautifulsoup4>=4.12.0 ``` Relevant automatic global-install recipes include: ```json { "id": "fix-pnpm-install", "title": "Install pnpm Package Manager", "safe_auto": true, "description": "Install pnpm globally", "steps": [ { "type": "command", "command": "npm install -g pnpm", "description": "Install pnpm via npm" }, { "type": "command", "command": "pnpm --version", "description": "Verify pnpm installation" } ] } ``` ```json { "id": "fix-openclaw-install", "title": "Install OpenClaw CLI", "safe_auto": true, "description": "Install openclaw command globally", "steps": [ { "type": "command", "command": "npm install -g openclaw", "description": "Install openclaw globally via npm" }, { "type": "command", "command": "openclaw --version", "description": "Verify openclaw installation" } ] } ``` ### Technical Analysis The Python installation command does not specify versions, while `requirements.txt` only defines lower bounds. The effective packages installed today can therefore differ from those reviewed with the Skill. No hash-locked dependency file is supplied. The repair database also marks global npm package installation and update operations as `safe_auto: true`. Package managers may execute lifecycle scripts during installation. A compromised publisher account, malicious future release, registry compromise, or dependency-chain compromise could consequently ex ...[truncated 1372 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (234)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: An interactive setup workflow that may install pnpm/OpenClaw, collect API keys, and generate or back up configuration files presents significant security and privacy risk if framed merely as diagnostics. The setup context makes this more dangerous because it invites users to disclose secrets and authorize modifications during first-run onboarding, when scrutiny is often lowest.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 95% confidence
Finding: A self-updater in a skill is inherently high risk because it can modify local code, reference data, or execution behavior after initial review. In this context, the skill already combines diagnostics, setup, and recommendations, so self-modification further erodes reviewability and can expand capabilities over time without equivalent scrutiny.
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
python3 {baseDir}/scripts/enhanced-doctor.py --json

text
### Self-Updater Keep references and caches current. ```bash # Check what's outdated

Self-Modification

High

Category: Rogue Agent
Confidence: 96% confidence
Finding: The explicit '--update' action indicates the skill can change local state rather than only inspect it. Self-modifying or self-refreshing behavior is dangerous because it can introduce new code/data, invalidate previous review assumptions, and potentially consume untrusted remote content.
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
Keep references and caches current.

bash
# Check what's outdated python3 {baseDir}/scripts/self-updater.py --check # Update everything python3 {baseDir}/scripts/self-updater.py --update

Self-Modification

High

Category: Rogue Agent
Confidence: 95% confidence
Finding: Repeated self-update capability, including targeted updates, confirms the skill supports mutation of its own local assets or caches. Even if limited to data, self-modification can still alter recommendations, diagnostics, or future command behavior in ways not visible at review time.
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
md
python3 {baseDir}/scripts/self-updater.py --check # Update everything python3 {baseDir}/scripts/self-updater.py --update # Update only skill cache python3 {baseDir}/scripts/self-updater.py --update --skills-only

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: A skills-only update may be narrower than full self-update, but it still modifies local trusted state and may influence future recommendations or actions. In a recommendation and maintenance tool, changing cached skill data can affect what users are encouraged to install or run.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
python3 {baseDir}/scripts/self-updater.py --update

Update only skill cache

python3 {baseDir}/scripts/self-updater.py --update --skills-only

text
### Setup Wizard

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · data/error-patterns.json (reported line 769)May include surrounding context.
json
"title": "Context Window Exceeded", "description": "Request exceeds model's context window limit", "causes": ["Too many tokens in prompt", "Large conversation history", "Big file attachment", "Context accumulation"], "fix_steps": ["Reduce prompt length", "Clear conversation history", "Use model with larger context window", "Implement context pruning"], "fix_recipe_id": "fix-config-validate", "related_codes": ["PAYLOAD_TOO_LARGE"], "doc_url": "https://docs.openclaw.ai/models/context-limits"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · data/error-patterns.json (reported line 27)May include surrounding context.
json
- Gateway rejects AI provider requests **Common Causes:** - Missing API key in .env file - Incorrect API key value - API key not activated with provider - Typo in environment variable name

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · data/error-patterns.json (reported line 41)May include surrounding context.
json
- Gateway rejects AI provider requests **Common Causes:** - Missing API key in .env file - Incorrect API key value - API key not activated with provider - Typo in environment variable name

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · data/fix-recipes.json (reported line 32)May include surrounding context.
json
- Gateway rejects AI provider requests **Common Causes:** - Missing API key in .env file - Incorrect API key value - API key not activated with provider - Typo in environment variable name

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · data/fix-recipes.json (reported line 33)May include surrounding context.
json
- Gateway rejects AI provider requests **Common Causes:** - Missing API key in .env file - Incorrect API key value - API key not activated with provider - Typo in environment variable name

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/authentication-errors.md (reported line 15)May include surrounding context.
md
- Gateway rejects AI provider requests **Common Causes:** - Missing API key in .env file - Incorrect API key value - API key not activated with provider - Typo in environment variable name

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/authentication-errors.md (reported line 136)May include surrounding context.
md
- Gateway rejects AI provider requests **Common Causes:** - Missing API key in .env file - Incorrect API key value - API key not activated with provider - Typo in environment variable name

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/authentication-errors.md (reported line 138)May include surrounding context.
md
- Gateway rejects AI provider requests **Common Causes:** - Missing API key in .env file - Incorrect API key value - API key not activated with provider - Typo in environment variable name

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/authentication-errors.md (reported line 187)May include surrounding context.
md
- Gateway rejects AI provider requests **Common Causes:** - Missing API key in .env file - Incorrect API key value - API key not activated with provider - Typo in environment variable name

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

SkillSpector

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Update only skill cache

Memory Manipulation

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access