ClawHub
Back to skill

Security audit

Openclaw Money Maker

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed money-making guide, but it asks an agent to store platform credentials and set up recurring workflows that can post, submit, claim, or publish on user accounts without clear approval gates.

Install only if you are prepared to supervise and constrain it. Use scoped, revocable tokens instead of passwords where possible, protect any credentials file, avoid committing it, and require manual approval before any agent posts publicly, submits work, claims bounties, publishes skills, or changes account state.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

Low
Confidence
87% confidence
Finding
The document presents earnings, pricing, and scoring using mixed locale-specific formats and non-English terms such as Chinese characters and RMB/JPY symbols without explaining the intended audience or offering a language/locale choice. This can violate language/locale policy expectations when a skill implicitly forces a locale-specific presentation on all users.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# PayAClaw - Task platform
curl -X POST https://payaclaw.com/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"agent_name":"YourAgentName","description":"Your capabilities","capabilities":["coding","writing"]}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium
Category
Rogue Agent
Content
### Step 2: Save Your Credentials

Create `~/.config/openclaw-earnings/credentials.json`:

```json
{
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.