Security audit

ClawShield

Security checks for vulnerabilities and agentic risk

Overview

This security skill needs review because its UI can show misleading clean results and its audit script scans broad local agent data without tight scoping or redaction.

Review this before installing. Do not rely on the panel's clean result. If you run the audit script, set WORKDIR explicitly to the intended OpenClaw install, keep the JSON report local, and assume it may contain sensitive lines from memory, installed skills, session/status output, and localhost service details.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T07 · Tool Hijacking and Spoofing

Error

Location: assets/panel.html:31
Finding: Static Panel Fabricates Successful Security Scan Results
Content: View full analysis
{ log('PI hits: 0 malicious'); log('Gateway: Safe'); document.getElementById('status').innerHTML = 'Status: 🟢 CLEAN'; }, 2000); } ``` ### Technical Analysis The recommended panel does not execute `scripts/audit.sh`, call a server endpoint, read an audit report, or validate the state of the OpenClaw installation. After a fixed two-second delay, it unconditionally displays zero malicious prompt-injection hits, a safe gateway, and a clean status. This behavior spoofs the output of a security tool. Execution failures, detected threats, unavailable dependencies, and unsafe gateway conditions cannot affect the displayed result. ### Attack Path 1. An OpenClaw installation contains a prompt-injection payload, unsafe gateway state, or another detectable condition. 2. The operator opens the recommended panel and selects **SCAN NOW**. 3. The `scan()` function only starts a timer and does not invoke the audit script. 4. The panel displays `PI hits: 0 malicious`, `Gateway: Safe`, and `CLEAN`. 5. The operator trusts the fabricated result and does not investigate or remediate the actual condition. ### Impact Assessment This issue does not directly grant operating-system privileges. Its security impact arises from suppressing accurate detection and misleading users responsible for security decisions. Any threat that the panel claims to assess may remain active because the panel always reports success. The scope includes every installation where this panel is used as the recommended security interface. It can cause missed prompt-injection findings, missed gateway issues, and prolonged exposure to an e ...[truncated 25 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/audit.sh:27
Finding: Recursive Agent Memory and Skill Scanning Exposes Complete Matching Lines
Content: View full analysis
"$PI_SCAN_FILE" for p in "${SCAN_PATHS[@]}"; do if [ -e "$p" ]; then grep -RInE --exclude-dir='.git' --exclude='*.png' --exclude='*.jpg' --exclude='*.jpeg' --exclude='*.gif' --exclude='*.webp' \ "$PI_PATTERNS" "$p" >>"$PI_SCAN_FILE" 2>/dev/null || true fi done ``` ```python "prompt_injection_hits": [l for l in read_file(os.environ["PI_SCAN_FILE"]).splitlines() if l.strip()], ``` ### Technical Analysis The script recursively searches the complete `memory` and `skills` trees under `WORKDIR`. It excludes several image extensions but does not otherwise restrict file types, file sizes, ownership, sensitivity, or the set of installed skills. When a pattern matches, `grep` writes the entire matching source line, including its path and line number, to a temporary file. The Python report generator then copies every complete matching line into the JSON report. Broad terms such as `system prompt`, `tool call`, `leak`, and `override` may occur in legitimate private content alongside credentials, tokens, personal information, internal URLs, or confidential instructions. Although the temporary directory is removed on exit, the final JSON is printed to standard output. The documented command redirects that output to `report.json`, and callers may also forward it to logs, CI artifacts, or alerting systems. ### Attack Path 1. A memory or skill file contains sensitive information on a line that also includes one of the broad detection terms. 2. The operator runs `bash scripts/audit.sh > report.json`. 3. Recursive `grep` reads the file using the invoking user's permissions. 4. The complete matching line is copied into `pi_scan. ...[truncated 1032 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/audit.sh:4
Finding: Hardcoded User-Specific Scan Root Can Target the Wrong Workspace
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:19
Finding: Documented Security Workflow Depends on Missing Executables
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented purpose and observed behavior do not align: the skill claims OpenClaw security auditing and prompt-injection detection, but the analysis indicates it performs a local port scan that is not clearly disclosed and does not implement some advertised checks. Security tooling that does more than it claims is dangerous because users may grant trust or deploy it broadly under false assumptions, while hidden scanning behavior can reveal system state, trigger policy violations, or mask ineffective security coverage.
Content: No source excerpt is available for this finding.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

Category: YARA Match
Confidence: 70% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · scripts/audit.sh (reported line 38)May include surrounding context.
sh
>"$PI_SCAN_FILE" for p in "${SCAN_PATHS[@]}"; do if [ -e "$p" ]; then grep -RInE --exclude-dir='.git' --exclude='*.png' --exclude='*.jpg' --exclude='*.jpeg' --exclude='*.gif' --exclude='*.webp' \ "$PI_PATTERNS" "$p" >>"$PI_SCAN_FILE" 2>/dev/null || true fi done # Local port scan (safe, loopback only) PORT_SCAN_FILE="$TMPDIR/port_scan.txt" if command -v nmap >/dev/null 2>&1; then (nmap -Pn -p 1-1024 127.0.0.1 || true) >"$PORT_SCAN_FILE" 2>&1 else echo "nmap not installed" >"$PORT_SCAN_FILE" fi # Build JSON report export TS OPENCLAW_STATUS_FILE GATEWAY_STATUS_FILE SESSION_STATUS_FILE PI_SCAN_FILE PORT_SCAN_FILE python3 - <<'PY' import json, os from pathlib import Path def read_file(path): try: return Path(path).read_text(errors='ignore') except Exception as e: return f"ERROR: {e}" report = { "timestamp": os.environ.get("TS", ""), "openclaw_status": read_file(os.environ["OPENCLAW_STATUS_FILE"]), "gateway_status": read_file(os.envir

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises operational behavior that reads configuration and report files and likely accesses environment/context, but it does not declare any explicit tool scope such as permissions or allowed-tools. In a security-focused skill, undeclared capabilities reduce reviewability and can enable broader file or environment access than users expect, increasing the risk of unintended data exposure or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script captures outputs from status commands, prompt-injection hits, and local scan results, then emits them wholesale as JSON without any user-facing disclosure, minimization, or redaction. Those outputs may contain sensitive operational details, filesystem contents, service metadata, or session information that could be exposed downstream to logs, other tools, or remote consumers.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script performs an active local port scan with nmap across ports 1-1024 on 127.0.0.1, which goes beyond simple file-based prompt-injection auditing and host status collection. Even though it is loopback-only, it enumerates local services and adds unnecessary system reconnaissance that can expose sensitive environmental details in the generated report.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The comment describes the scan as limited and safe/local, but the code recursively greps both the memory directory and the entire skills workspace. That mismatch can cause overcollection of unrelated skill contents, prompts, or secrets, increasing privacy risk and making operator consent less informed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.