T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:44- Finding
Unauthenticated report content is treated as a trusted handoff
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawGuard Security Assistant
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent OpenClaw security helper, but its remediation and local-scan guidance can lead users or agents to run commands and edit files with insufficient safeguards.
Review before installing. Use the report parsing and explanation features with ordinary caution, but do not let the skill apply fixes from unverified reports or handoffs. Avoid L2 local scans unless you trust clawguardsecurity.ai, inspect the generated command first, and are comfortable sending local security metadata to that service. Prefer manually reviewing any proposed file path, diff, backup location, and validation command before approving changes.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/fix-procedures.md:17- Finding
Report-controlled paths and patch content can target files outside the intended configuration scope
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/fix-procedures.md:56- Finding
Report-controlled file path is interpolated into executable Python and shell syntax
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/scan-guide.md:32- Finding
Skill directs users to execute an unpinned command generated by a remote website
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
references/scan-guide.md:7- Finding
L2 scanning transfers broadly scoped local security data without documented minimization controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (19)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md - **Fix**: Move plaintext keys from config to `openclaw secrets` - **Breaks**: Skills that read keys directly from config file paths - **Detect**: Search skill files for config paths that reference the moved keys - **Mitigate**: Update skill env declarations to use the secrets store reference ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md **B. Skill-side adaptation** -- Update the affected skill's config. - Add skill to an exception list. - Update skill's `requires` declaration. **C. Staged rollout** -- Apply in audit mode first (log but don't block), observe for 7 days, then enforce.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### OC-013 When `tools.fs.workspaceOnly` is missing or set to false, the agent's file system tools operate with the full permissions of the host process rather than being scoped to the project workspace. This allows the agent to access sensitive files outside the repository, including SSH keys, cloud credentials, shell history, and environment configuration. A prompt injection attack embedded in any input the agent processes can direct it to read `~/.aws/credentials`, exfiltrate private keys, or overwrite system configuration files. Even absent malicious intent, an agent that misinterprets a file path can accidentally corrupt files in unrelated directories. Setting `workspaceOnly` to true establishes a boundary at the application layer, ensuring all file operations are resolved and validated against the workspace root before execution. ### OC-014
YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md directory without verifying that each one has been reviewed and approved. A malicious or compromised plugin receives the same execution context as a trusted one: it can register tool handlers, intercept message flows, read configuration, and make outbound network requests. An attacker who can place a single file in the plugin directory — via a supply-chain compromise, a shared filesystem, or a social-engineering install — gains persistent code execution inside the gateway process. Because plugins run with the gateway's own privileges, the blast radius includes every tool, every channel, and every credential the gateway can reach. Defining an explicit `plugins.allow` list that names only audited plugin identifiers causes the loader to skip any plugin not on the list. ### OC-025 When `dangerouslyAllowPrivateNetwork` is set to true, the agent's browser sandbox can issue HTTP requests to RFC 1918 addresses, link-local ranges, and localhost services that are normally unreachable from
Cloud Metadata Access
High
- Category
- Server-Side Request Forgery
- Confidence
- 90% confidence
- Finding
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.
- Content
md ### OC-025 When `dangerouslyAllowPrivateNetwork` is set to true, the agent's browser sandbox can issue HTTP requests to RFC 1918 addresses, link-local ranges, and localhost services that are normally unreachable from the public internet. An attacker exploits this by crafting a prompt that instructs the agent to fetch a URL pointing to an internal service — for example, a cloud metadata endpoint at `169.254.169.254`, an internal admin panel, or a database REST API. The agent's browser makes the request and returns the response body to the conversation context, leaking internal data such as IAM credentials, configuration details, or health-check output. This is a server-side request forgery (SSRF) vector that is especially dangerous because the agent can be manipulated through natural-language prompt injection rather than requiring a traditional code-level vulnerability. Setting the flag to false restores the default deny policy for private-network destinations. ### OC-026
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The usage section says users can 'talk to your OpenClaw agent naturally' and includes a trigger example, 'Help me check my OpenClaw security,' that overlaps with common conversational language. The README does not define clear trigger boundaries, exclusions, or negative examples, so activation scope is ambiguous for a markdown skill description.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs the agent to read local reference files and a parsing script via
{baseDir}/references/...and{baseDir}/scripts/parse-report.py, which implies file-read capability, but it does not declare any explicit tool scope such aspermissionsorallowed-tools. Missing scope declarations weaken least-privilege controls and can let the runtime grant broader file access than intended, increasing the risk of unintended local file exposure if the skill or router behavior is abused.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Rule | Severity | Title | |------|----------|-------| | OC-098 | MEDIUM | No approval or change record for enabling new plugins or tool groups | | OC-099 | MEDIUM | Pairing allowlists and wildcard sender rules not periodically reviewed | ## Enterprise Baseline
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md |---|---| | bind to 0.0.0.0 | your AI gateway is open to the entire network, not just this machine | | auth disabled / auth.mode = none | anyone can connect without a password | | exec tool unrestricted | the AI can run any command on your computer with no limits | | plaintext API key in config | your secret key is stored in plain text like a postcard anyone can read | | allowlist / denylist | whitelist (only allow specific items) / blacklist (block specific items) | | SSRF | the AI was tricked into accessing internal servers it shouldn't reach |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### FS-001: File System Paths Restricted - **Fix**: Narrow filesystem `allow_paths` - **Breaks**: Skills that read/write outside the new allowed scope - **Detect**: Search `SKILL.md` files for file paths and Read/Write tool usage - **Mitigate**: Add per-skill path exceptions; or use read-only access for broader paths
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ### FS-002: State Directory Permissions Tightened - **Fix**: `chmod 700` on `~/.openclaw/` - **Breaks**: Nothing usually -- other system users lose access (which is the point) - **Detect**: Check if multi-user setup exists - **Mitigate**: Grant specific group access if needed
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The batch-fix flow is activated by very broad natural-language phrases such as "fix all" and "fix all critical," which can be matched in ordinary discussion rather than as a deliberate authorization to modify files. In a skill that edits configuration files and performs sequential changes, ambiguous activation increases the risk of unintended bulk modifications from conversational context, quoted text, or misunderstood user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Using ambiguous rollback triggers like "undo" or "rollback" without scope constraints can cause restoration of backups when the user may be referring to a prior conversational step rather than a filesystem action. Because rollback overwrites real configuration files, an accidental trigger can revert valid changes and create service disruption or loss of intentional updates.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### OC-004 When `gateway.controlUi.allowedOrigins` is missing or empty on a non-loopback deployment, the gateway does not enforce CORS origin restrictions on the Control UI. This makes the gateway vulnerable to DNS rebinding attacks, where an attacker-controlled domain is re-resolved to the gateway's LAN IP after the victim's browser loads the attacker's page. The victim's browser then treats requests to the gateway as same-origin with the attacker's domain, allowing the attacker's JavaScript to read and write through the Control UI API. Because the gateway has no origin allowlist to reject these requests, the browser-side defense that would normally block cross-origin access is completely bypassed. If gateway authentication and device pairing are also absent (OC-001 and OC-005), the attacker's JavaScript gains full unauthenticated control with zero user interaction beyond visiting a webpage. So the result is that any website the operator visits can silently read conversation data, invoke agent tools, and modify configuration through the operator's own browser. ### OC-005
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md ### OC-011 When `tools.exec.security` is missing or set to neither a deny list nor an allow list, the agent runtime places no restrictions on which shell commands the agent can invoke. This means the agent can execute arbitrary commands on the host operating system, including package installation, process management, network requests, and file deletion. An attacker who gains influence over the agent's reasoning — through prompt injection in a document, a crafted API response, or a malicious repository file — can leverage this unrestricted execution to exfiltrate environment variables, install backdoors, or pivot laterally across the network. Even without adversarial input, a miscalibrated agent may autonomously run destructive commands based on a misinterpreted user request. Configuring a deny list blocks known-dangerous commands, while an allow list restricts execution to a pre-approved set; both approaches create a hard boundary that the agent cannot override regardless of its reasoning chain. ### OC-012
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### OC-011 When `tools.exec.security` is missing or set to neither a deny list nor an allow list, the agent runtime places no restrictions on which shell commands the agent can invoke. This means the agent can execute arbitrary commands on the host operating system, including package installation, process management, network requests, and file deletion. An attacker who gains influence over the agent's reasoning — through prompt injection in a document, a crafted API response, or a malicious repository file — can leverage this unrestricted execution to exfiltrate environment variables, install backdoors, or pivot laterally across the network. Even without adversarial input, a miscalibrated agent may autonomously run destructive commands based on a misinterpreted user request. Configuring a deny list blocks known-dangerous commands, while an allow list restricts execution to a pre-approved set; both approaches create a hard boundary that the agent cannot override regardless of its reasoning chain. ### OC-012
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ### OC-013 When `tools.fs.workspaceOnly` is missing or set to false, the agent's file system tools operate with the full permissions of the host process rather than being scoped to the project workspace. This allows the agent to access sensitive files outside the repository, including SSH keys, cloud credentials, shell history, and environment configuration. A prompt injection attack embedded in any input the agent processes can direct it to read `~/.aws/credentials`, exfiltrate private keys, or overwrite system configuration files. Even absent malicious intent, an agent that misinterprets a file path can accidentally corrupt files in unrelated directories. Setting `workspaceOnly` to true establishes a boundary at the application layer, ensuring all file operations are resolved and validated against the workspace root before execution. ### OC-014
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The L2 Local Scan steps instruct users to run a generated terminal command without a prominent warning that scan results are transmitted to a server and may include sensitive local system data such as binaries, logs, permissions, or runtime state. Although the comparison table earlier mentions server analysis, the actionable execution steps omit an explicit privacy warning at the point of action, which can mislead users into disclosing data they did not realize would leave the host.
- Content
Excessive Permissions
Low
- Category
- Privilege Escalation
- Confidence
- 75% confidence
- Finding
Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
- Content
md ### OC-001 When `gateway.bind` is set to a non-loopback address such as `0.0.0.0`, the gateway accepts connections from every network interface on the host, including WiFi and LAN. When `gateway.auth.mode` is also missing or set to `none`, no credential check stands between a network client and the gateway API. This means any device on the same network can reach the gateway and issue requests without proving identity. Those requests grant full access to conversation history, agent tool invocation (including `system.run` for command execution), and filesystem operations. An attacker on a shared network needs only a browser or `curl` to discover the gateway port and connect. So the result is unauthenticated remote code execution and data exfiltration from any machine on the local network, achievable in under two minutes with default port settings. ### OC-002
Static analysis
No suspicious patterns detected.