OpenClaw CLI

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:16 PM UTC
• Version: 1.0.0

Overview

This is a plain OpenClaw CLI helper skill with disclosed command guidance and no embedded executable payload.

Before installing, prefer a tagged or pinned commit from a repository you trust, and review changes before updating. When using the skill, pay attention to confirmation prompts for reset, uninstall, force, credential-clearing, message delivery, plugin, cron, or update commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:26

Finding

Unpinned Remote Repository Installed into a Trusted Skills Directory

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 26-31
Vulnerability Type: Supply-chain risk from an unpinned remote dependency
Risk Level: Medium

Vulnerable Code Snippet:

bash

mkdir -p ~/.codex/skills
git clone https://github.com/ramensushi2026/openclaw-cli-skill.git ~/.codex/skills/openclaw-cli

Technical Analysis

The documented installation procedure clones the repository's mutable default branch directly into ~/.codex/skills, a directory from which Codex skills may be loaded and trusted. It does not pin an immutable commit, require a signed release, or verify a checksum or cryptographic signature.

Consequently, the content installed by this command can differ from the version reviewed during this audit. This does not demonstrate that the current repository is malicious; however, it creates an unsafe supply-chain path. A compromise of the repository owner, hosting account, or default branch could introduce modified instructions, configuration, or executable components into future installations without an independent integrity check.

Attack Path

1. An attacker compromises the upstream repository account or otherwise obtains permission to modify its default branch.
2. The attacker adds malicious skill instructions, configuration, or executable content to the repository.
3. A user follows the documented installation command, which retrieves the current default branch without pinning or verification.
4. The altered repository is written directly to ~/.codex/skills/openclaw-cli.
5. Codex loads or invokes the attacker-controlled skill content under the user's existing permissions.

Impact Assessment

Successful exploitation could allow attacker-controlled skill instructions or subsequently introduced code to operate with the permissions available to the user's Codex environment. Depending on the malicious content and enabled tools, the potential scope could include manipula ...[truncated 438 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish reviewed releases and instruct users to check out an immutable commit hash or verified signed tag rather than the mutable default branch.
2. Provide a SHA-256 checksum or cryptographic signature for each approved release and document the verification steps.
3. Clone into a staging directory first, verify the revision and integrity, and only then copy the reviewed content into ~/.codex/skills/openclaw-cli.
4. Protect release tags and the default branch with mandatory review, branch protection, and multi-factor authentication.
5. Document a secure update procedure that requires users to review changes and repeat integrity verification before replacing an installed skill.
6. Prefer a versioned distribution mechanism that preserves immutable artifacts and provenance attestations.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

Clone this repo into your Codex skills directory:

bash

mkdir -p ~/.codex/skills
git clone https://github.com/ramensushi2026/openclaw-cli-skill.git ~/.codex/skills/openclaw-cli

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

Clone this repo into your Codex skills directory:

bash

mkdir -p ~/.codex/skills
git clone https://github.com/ramensushi2026/openclaw-cli-skill.git ~/.codex/skills/openclaw-cli

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/command-map.md (reported line 89)May include surrounding context.

md

- `security *`: Security tooling and local config audits.
- `sessions`: List stored conversation sessions.
- `setup`: Initialize local config and workspace.
- `skills *`: List and inspect available skills.
- `status`: Show channel health + recent recipients.
- `system *`: System events, heartbeat, presence.
- `tui`: Open terminal UI connected to Gateway.

Static analysis

No suspicious patterns detected.