ClawHub
Back to skill

Security audit

Zanna Aperta

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed OpenClaw bridge, but it gives agents broad local admin powers without enough scoping, consent, or recovery safeguards.

Install only if you intentionally want an agent to administer your OpenClaw environment. Use a dedicated, disposable OPENCLAW_WORKSPACE, pin OPENCLAW_BIN to a trusted binary, and require out-of-band confirmation before delete, cron, Docker/Git, browser, canvas_eval, camera, messaging, agent kill/update, gateway restart, or ClawX start/stop actions.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tainted flow: 'OPENCLAW_BIN' from os.environ.get (line 17, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
"""Trova agenti usando subagents list e sessions_list"""
    try:
        # Usa subagents per trovare agenti
        result = subprocess.run(
            [OPENCLAW_BIN, "tool", "subagents", "action", "list"],
            capture_output=True, text=True, timeout=30
        )
Confidence
88% confidence
Finding
OPENCLAW_BIN is sourced from an environment variable and then executed as the program path in many subprocess calls. If an attacker can influence the environment, they can replace the intended binary with an arbitrary executable and gain code execution in the skill's trust context.

Tainted flow: 'WORKSPACE' from os.environ.get (line 16, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
def exec_git(command: str = "") -> Dict[str, Any]:
    """Esegue comando Git"""
    try:
        result = subprocess.run(
            ["git"] + command.split(),
            capture_output=True, text=True, timeout=30, cwd=WORKSPACE
        )
Confidence
91% confidence
Finding
exec_git accepts an arbitrary command string and executes git with command.split() in a workspace path controlled by environment configuration. Although shell metacharacter injection is avoided, this still exposes dangerous arbitrary Git subcommands, including options that run external helpers, touch the filesystem, or manipulate repositories in sensitive directories.

Tainted flow: 'ws_path' from os.environ.get (line 120, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
# Salva metadata
        meta = {"uuid": uuid, "name": workspace_name, "created": True}
        with open(os.path.join(ws_path, "workspace.json"), "w") as f:
            json.dump(meta, f, indent=2)
        
        return {"content": [{"type": "text", "text": f"Workspace creato: {ws_path}"}]}
Confidence
90% confidence
Finding
workspace_create builds ws_path from user-controlled uuid/workspace_name and writes files there without canonicalization or traversal checks. An attacker can use path traversal segments to create directories and files outside the intended workspace root if the process has permission.

Tainted flow: 'project_file' from os.environ.get (line 286, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
## Note
"""
        with open(project_file, "w") as f:
            f.write(content)
        
        # Salva anche in ACTIVE.md
Confidence
92% confidence
Finding
project_create uses user-controlled project_name/uuid to construct project_dir and project_file, then writes to disk without verifying the resolved path. This enables path traversal and arbitrary file write within the service's permissions, which is especially dangerous because the content written is attacker-influenced markdown.

Tainted flow: 'project_file' from os.environ.get (line 286, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
# Aggiorna contenuto
            content += f"\n\n## Aggiornamento {key}\n{value}"
            
            with open(project_file, "w") as f:
                f.write(content)
            
            return {"content": [{"type": "text", "text": f"Progetto {target} aggiornato"}]}
Confidence
90% confidence
Finding
project_update derives the project path from user input and rewrites project.md without checking whether the resolved path stays under the projects directory. This can allow arbitrary file overwrite through traversal if crafted names map outside the intended root.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The skill exposes broad host command execution through exec_docker and exec_git, allowing an agent to run arbitrary Docker and Git subcommands on the local system. In an MCP skill context, this is dangerous because it exceeds a narrow bridge role and can enable container abuse, repository tampering, file access, credential exposure, and indirect code execution.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The skill can start, stop, and restart a local ClawX development server process, giving the agent host process lifecycle control that is broader than a simple OpenClaw bridge. That expands the attack surface to persistence, unintended service exposure, and disruption of local developer tooling.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The tool list includes destructive and execution-capable operations such as delete, restart, docker, git, cron, and browser control, yet the documentation contains no warning about their operational or security impact. In an agent ecosystem, omission of these warnings increases the likelihood of unsafe delegation and accidental misuse of sensitive host capabilities.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
workspace_delete performs irreversible recursive deletion with shutil.rmtree based on workspace metadata lookup, without confirmation, soft-delete, or path safety guardrails. In an agentic environment, accidental or malicious invocation can destroy user data quickly and silently.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
project_delete irreversibly removes project directories without warning, confirmation, or recovery controls. This is dangerous because agent-triggered destructive actions can cause permanent loss of project state and memory artifacts.

Missing User Warnings

High
Confidence
97% confidence
Finding
nodes_camera_snap enables remote camera capture from a connected device with no visible consent flow, privacy notice, or access restriction. In an agent skill, this creates serious surveillance and privacy risk because an agent can trigger image capture on user-associated devices.

Static analysis

No suspicious patterns detected.