OpenClaw故障排除工具

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:51 PM UTC
• Version: 1.1.0

Overview

The skill is a real troubleshooting tool, but its repair paths can automatically install software and loosen permissions across the OpenClaw workspace without clear user confirmation.

Review this skill before installing on a shared or sensitive machine. Use diagnostic commands first, avoid quick_start.py and fix all unless you have reviewed the exact effects, back up the OpenClaw workspace, and prefer running dependency repairs in an isolated virtual environment rather than allowing system or user-level pip changes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/openclaw_troubleshooting.py:291

Finding

Recursive Permission Repair Exposes the Entire OpenClaw Workspace

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/openclaw_troubleshooting.py:256

Finding

Runtime Installation of Unpinned Packages Through Untrusted Pip Configuration

Content

View full analysis

=2.31.0 beautifulsoup4>=4.12.2 lxml>=5.1.0 json5>=0.9.14 python-dotenv>=1.0.1 ``` ### Technical Analysis The repair function installs packages at runtime using bare package names and the environment's existing pip configuration. It does not pin exact versions, verify cryptographic hashes, enforce a trusted package index, or create an isolated virtual environment. Pip may obtain packages from an index selected through global configuration, user configuration, environment variables, or command-line defaults. A compromised or attacker ...[truncated 3068 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (44)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented purpose is troubleshooting and optimization, but the detected behavior includes modifying skill metadata/files, running version upgrade flows, invoking external subprocesses for publishing, and publishing skills to ClawHub. That is a substantial privilege and behavior expansion beyond user-expected troubleshooting, creating a risk of unauthorized code/package changes or supply-chain actions under the guise of repair. A description-behavior mismatch is especially dangerous because it defeats informed consent and makes risky actions easier to hide.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document repeatedly promotes 'automatic diagnosis, repair, and optimization' and later acknowledges 'data loss risk' and other high-risk outcomes, but it does not warn users to review changes, take backups, or require explicit confirmation before impactful actions. In a troubleshooting skill, this omission is dangerous because users are primed to trust automated fixes that may alter system state, permissions, dependencies, or files without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation advertises automatic repair capabilities such as dependency installation, permission repair, and workspace optimization without clearly warning that these actions may modify the local environment, install software, or alter filesystem permissions. In a troubleshooting skill, users are likely to trust and run these actions directly, which increases the chance of unintended system changes or data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The listed commands include broad fix operations such as 'fix all', 'fix dependencies', and 'fix permissions' with no visible caution, scope limitation, or backup advice. Commands that alter dependencies or permissions can have security and availability consequences if run blindly, especially in a developer workstation context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises automatic diagnosis and repair actions such as installing dependencies, fixing permissions, and repairing paths/workspace state, but it does not warn users that these actions can change their system or require confirmation. In a troubleshooting skill, undocumented modification behavior increases the risk of unintended package installs, permission changes, or filesystem alterations triggered by a user seeking simple diagnostics.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The invocation example uses a broad natural-language trigger ('我遇到了OpenClaw的问题，帮我诊断一下') that is close to an ordinary support request rather than a clearly scoped command. In an agent environment, this can cause the skill to activate unexpectedly during general conversation and potentially lead into automated troubleshooting or repair flows with side effects.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises automated diagnosis, repair, optimization, and reporting, which strongly implies use of powerful capabilities such as shell, filesystem, environment access, and possibly network access. However, the manifest does not declare any tool scope or permissions boundaries, so users and the platform cannot verify or constrain what the skill may do at runtime. In a troubleshooting skill that may modify configs, install dependencies, and clear caches, missing scope declarations materially increases the risk of overreach or unintended destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill promises automated repairs, dependency installation, path/permission fixes, and cache cleanup without warning that these actions may change system state. In a troubleshooting context, such actions can alter environments, remove cached data, or affect other applications, so omission of warnings increases the chance of accidental disruption and unsafe user trust. The danger is amplified because 'automatic fix' language encourages execution without careful review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Log analysis and report generation can process sensitive information such as file paths, usernames, tokens, hostnames, stack traces, and proprietary content. Without any privacy or data-handling notice, users may unknowingly expose sensitive data to storage, summaries, or external transmission, particularly if reports are shared or uploaded. In a troubleshooting skill, this is a real confidentiality risk because logs commonly contain secrets and operational details.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains user-facing natural-language strings and docstrings exclusively in Chinese, including the module description and runtime output. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and no alternative language option or justification is provided here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/openclaw_troubleshooting.py (reported line 40)May include surrounding context.

python

machine = platform.machine()
            
            if system == 'Darwin':
                mac_version = subprocess.check_output(['sw_vers', '-productVersion'], text=True).strip()
                return {
                    "system": system,
                    "version": mac_version,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/openclaw_troubleshooting.py (reported line 48)May include surrounding context.

python

"full_version": platform.version()
                }
            elif system == 'Linux':
                distro = subprocess.check_output(['lsb_release', '-d'], text=True).strip().split(':')[1].strip()
                return {
                    "system": system,
                    "version": version,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/openclaw_troubleshooting.py (reported line 75)May include surrounding context.

python

try:
            version = platform.python_version()
            interpreter = sys.executable
            pip_version = subprocess.check_output([sys.executable, '-m', 'pip', '--version'], text=True).strip()
            
            return {
                "version": version,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/openclaw_troubleshooting.py (reported line 115)May include surrounding context.

python

missing_packages = []
        
        try:
            pip_output = subprocess.check_output([sys.executable, '-m', 'pip', 'list'], text=True)
            
            for package in required_packages:
                if re.search(rf'\b{re.escape(package)}\b', pip_output, re.IGNORECASE):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/openclaw_troubleshooting.py (reported line 195)May include surrounding context.

python

missing_packages = []
        
        try:
            pip_output = subprocess.check_output([sys.executable, '-m', 'pip', 'list'], text=True)
            
            for package in required_packages:
                if re.search(rf'\b{re.escape(package)}\b', pip_output, re.IGNORECASE):

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill modifies the Python environment by automatically running package installs, including forced system-level installs with --break-system-packages. This is dangerous because it can execute unreviewed package code, break managed environments, and create persistence or dependency-confusion risk under the guise of troubleshooting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Automatic package installation without warning or confirmation removes an important safety checkpoint before executing code-fetching and environment-modifying operations. In a troubleshooting skill, this raises the chance that users will trigger risky changes unintentionally while expecting safe diagnostics.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

This installs Python packages automatically and even uses --break-system-packages, which can modify protected system environments and override package-management safeguards. In a troubleshooting skill, this is more dangerous because users may run it expecting diagnostics, but it can perform high-impact environment changes that destabilize the host or introduce unreviewed code from package repositories.

Content

Scanner excerpt · scripts/openclaw_troubleshooting.py (reported line 268)May include surrounding context.

python

# Try to install with --break-system-packages flag
            try:
                for package in missing_packages:
                    subprocess.check_output([sys.executable, '-m', 'pip', 'install', package, '--break-system-packages'])
                
                print("✅ 依赖项安装完成")
                return True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

This fallback path still performs automatic package installation, albeit in user mode. While less severe than system-level installation, it still executes package-management changes without review and can pull arbitrary third-party code into the runtime environment.

Content

Scanner excerpt · scripts/openclaw_troubleshooting.py (reported line 280)May include surrounding context.

python

# Try to install with --user flag
                try:
                    for package in missing_packages:
                        subprocess.check_output([sys.executable, '-m', 'pip', 'install', package, '--user'])
                    
                    print("✅ 依赖项安装完成")
                    return True

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill recursively changes filesystem permissions over the workspace and skills directories. Broad recursive permission changes can unintentionally expose data, weaken local access controls, and damage the integrity of project files, especially when the path is derived from relative directory traversal.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The recursive chmod operation changes permissions without explicit safety messaging or confirmation. That is dangerous because permission changes are high-impact, potentially irreversible at scale, and may weaken confidentiality or integrity protections across the workspace.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

This recursively changes permissions on the computed workspace directory to 755, which can broaden access to all files and subdirectories under that tree. In a troubleshooting skill, automatically mass-changing permissions is dangerous because it may expose sensitive workspace contents or alter security assumptions without confirmation.

Content

Scanner excerpt · scripts/openclaw_troubleshooting.py (reported line 297)May include surrounding context.

python

try:
            # Fix workspace permissions
            if os.path.exists(self.workspace_dir):
                subprocess.check_output(['chmod', '-R', '755', self.workspace_dir])
            
            # Fix custom skills directory permissions
            custom_skills_dir = os.path.join(self.workspace_dir, 'custom-skills')

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

This performs another recursive chmod 755 on the custom-skills directory, potentially making skill contents broadly readable and executable. If that directory contains private code, tokens, or configuration files, the permission widening can create unintended exposure or facilitate tampering by local users.

Content

Scanner excerpt · scripts/openclaw_troubleshooting.py (reported line 302)May include surrounding context.

python

# Fix custom skills directory permissions
            custom_skills_dir = os.path.join(self.workspace_dir, 'custom-skills')
            if os.path.exists(custom_skills_dir):
                subprocess.check_output(['chmod', '-R', '755', custom_skills_dir])
            
            print("✅ 权限修复完成")
            return True

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code presents its top-level description in Chinese and consistently emits Chinese user-facing status/error messages throughout the script, indicating a fixed language choice. The file provides no opt-in, locale selection, or justification that this is a region-specific tool, which conflicts with the policy against forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script launches external test and publishing subprocesses that are unrelated to end-user troubleshooting scope, broadening the behavior of the skill package beyond its stated purpose. This increases attack surface and trust risk because users or reviewers expecting diagnostic tooling may inadvertently run release-oriented commands with network or account implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.