Openclaw Admin Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:54 AM UTC
• Version: 1.2.0

Overview

The skill is a coherent OpenClaw administration helper, but it asks for broad local admin access and includes an overbroad full-config read that could expose inline credentials.

Review before installing in environments with real OpenClaw credentials. Use narrow `openclaw config get <key>` reads instead of printing the full config, confirm any restart/write/delete action, and do not let the skill fetch online docs with local logs, config, session text, or secrets attached.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:215

Finding

Unredacted Full Configuration Ingestion May Expose Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 215–220
Vulnerability Type: Sensitive configuration exposure through an overbroad read operation
Risk Level: Medium

Vulnerable Code

markdown

1. **Read** current config: `cat ~/.openclaw/openclaw.json` or `openclaw config get <key>`
2. **Backup**: `cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak-$(date +%Y%m%d-%H%M%S)`
3. **Edit** individual keys (or use `openclaw config set <key> <value>`)
4. **Validate**: `openclaw config validate`
5. **Restart only if needed**: most config hot-reloads automatically. See config-map.md for what requires `openclaw gateway restart`.

Technical Analysis

The safe-editing workflow permits the agent to execute cat ~/.openclaw/openclaw.json, which places the complete configuration file into command output and potentially into the agent context, conversation transcript, tool logs, or other retained execution records.

Although the skill explicitly prohibits reading ~/.openclaw/secrets.json and ~/.openclaw/.env, openclaw.json may itself contain inline gateway tokens, provider credentials, OAuth material, plugin API keys, remote gateway tokens, or other private configuration. Reading the entire file is therefore broader than necessary for routine single-key diagnosis or modification and conflicts with the skill's otherwise restrictive secret-handling policy.

The safer alternative shown in the same line, openclaw config get <key>, does not eliminate the issue because the workflow presents full-file ingestion as an equally valid default. No automatic upload or confirmed external exfiltration mechanism was found; the vulnerability is the unnecessary disclosure of sensitive data to the agent and its surrounding logging or retention systems.

Attack Path

1. A user asks the agent to diagnose or change an individual OpenClaw setting.
2. The agent follows the documented mand ...[truncated 1615 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove cat ~/.openclaw/openclaw.json from the default workflow.
2. Require narrowly scoped reads such as:

   bash

   openclaw config get <specific-key>
   

3. If full-file inspection is genuinely necessary, obtain explicit user approval and explain that the file may contain inline credentials.
4. Use a local redaction process that suppresses values associated with names such as token, secret, password, apiKey, authorization, credential, and private-key fields before output reaches the agent.
5. Avoid printing redacted secret fragments, lengths, prefixes, or suffixes unless they are strictly required for diagnosis.
6. Update the workflow to state that configuration backups must remain local, use restrictive file permissions, and must not be attached to external support requests.
7. Add an explicit policy that only the minimum configuration subtree necessary for the current operation may be read.
8. Add a consistency check ensuring that all configuration-reading guidance follows the same safeguards already applied to .env, secrets.json, sessions, and workspaces.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad OpenClaw operations/admin skill focused on managing and troubleshooting actual OpenClaw deployments and components. The supplied code does something materially narrower and different: it refreshes a local cache of OpenClaw documentation pages. While documentation refresh could support admin workflows indirectly, the primary behavior is not operational diagnosis, configuration, installation, or repair of OpenClaw itself. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

- Keep `SKILL.md` generic. Do not add user-specific hostnames, ports, profiles, or service names here.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

This skill operates **locally only** on the user's OpenClaw installation. Before acting, observe these rails:

- **Never open `~/.openclaw/secrets.json` or `~/.openclaw/.env`.** Reference them by path when explaining config, but do not read their contents into the conversation, tool output, logs, or any external destination. If a diagnostic genuinely requires a secret value, ask the user to paste the specific field.
- **Never transmit config, env, secrets, session data, or agent workspace contents to any external service** (web fetches, paste sites, third-party APIs, remote agents). Local commands and user-approved doc lookups only.
- **Require explicit user confirmation before any of:**
  - writing to `~/.openclaw/openclaw.json` beyond a single validated `openclaw config set`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

This skill operates **locally only** on the user's OpenClaw installation. Before acting, observe these rails:

- **Never open `~/.openclaw/secrets.json` or `~/.openclaw/.env`.** Reference them by path when explaining config, but do not read their contents into the conversation, tool output, logs, or any external destination. If a diagnostic genuinely requires a secret value, ask the user to paste the specific field.
- **Never transmit config, env, secrets, session data, or agent workspace contents to any external service** (web fetches, paste sites, third-party APIs, remote agents). Local commands and user-approved doc lookups only.
- **Require explicit user confirmation before any of:**
  - writing to `~/.openclaw/openclaw.json` beyond a single validated `openclaw config set`

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

Copy the skill files into your Claude Code skills directory:

bash

mkdir -p ~/.claude/skills/openclaw-admin
mkdir -p ~/.claude/skills/openclaw-admin/scripts
cp SKILL.md ~/.claude/skills/openclaw-admin/SKILL.md
cp local-install.md ~/.claude/skills/openclaw-admin/local-install.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

Copy the skill files into your Claude Code skills directory:

bash

mkdir -p ~/.claude/skills/openclaw-admin
mkdir -p ~/.claude/skills/openclaw-admin/scripts
cp SKILL.md ~/.claude/skills/openclaw-admin/SKILL.md
cp local-install.md ~/.claude/skills/openclaw-admin/local-install.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

Copy the skill files into your Claude Code skills directory:

bash

mkdir -p ~/.claude/skills/openclaw-admin
mkdir -p ~/.claude/skills/openclaw-admin/scripts
cp SKILL.md ~/.claude/skills/openclaw-admin/SKILL.md
cp local-install.md ~/.claude/skills/openclaw-admin/local-install.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

bash

mkdir -p ~/.claude/skills/openclaw-admin
mkdir -p ~/.claude/skills/openclaw-admin/scripts
cp SKILL.md ~/.claude/skills/openclaw-admin/SKILL.md
cp local-install.md ~/.claude/skills/openclaw-admin/local-install.md
cp config-map.md ~/.claude/skills/openclaw-admin/config-map.md
cp update-failure-patterns.md ~/.claude/skills/openclaw-admin/update-failure-patterns.md

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill clearly instructs the agent to use shell commands extensively, but it does not declare an explicit tool scope such as allowed-tools or permissions. That omission weakens policy enforcement and makes it easier for the skill to exercise broad filesystem and process control capabilities without transparent constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says to use the skill for 'installing, updating, diagnosing, configuring, fixing, tuning, or setting up anything in OpenClaw' and 'any operational task' involving broad OpenClaw components. This is an expansive trigger that lacks clear boundaries or negative examples, increasing the chance of unintended invocation for routine requests that merely mention OpenClaw.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The phrase 'any operational task involving openclaw.json, the gateway, agents, channels, or the openclaw CLI' is highly broad and does not define what should not trigger the skill. Without clearer scope constraints, ordinary conversation about these components could match the trigger.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill claims to operate locally only, but later directs the agent to fetch remote documentation and use online lookups. That contradiction can mislead users and safety systems into approving the skill under a stricter trust model than its actual behavior, increasing the risk of unintended data exposure during troubleshooting.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The explicit local-only assurance is contradicted by instructions to access docs.openclaw.ai, GitHub, and WebFetch. Such self-contradictory safety language is dangerous because it can cause users to underestimate the skill's external communication surface and authorize it in sensitive environments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

- rotating, deleting, or overwriting tokens, OAuth profiles, or plugin credentials
  - deleting agents, sessions, plugins, or cron jobs
  - any `rm`, `mv`, or destructive git/systemd action touching OpenClaw state
- **Back up before editing.** Use the Safe Config Editing Workflow below for any `openclaw.json` change — never batch-write the whole file.
- **Read-only investigation is fine without asking** (status commands, log tailing, config validation, grepping docs).
- **Agent sessions and workspaces may contain user conversations, prompts, and PII.** Listing them (names, timestamps, sizes, file paths) is fine without asking. Before reading the *contents* of any file under `~/.openclaw/agents/<id>/sessions/` or an agent workspace, ask the user first — explain what you're looking for and why so they can approve, narrow the scope, or point you at the right session (they may not know which one without your help). Never quote or summarize session bodies in external fetches, cross-agent messages, or any destination outside this conversation, even after approval.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md

- deleting agents, sessions, plugins, or cron jobs
  - any `rm`, `mv`, or destructive git/systemd action touching OpenClaw state
- **Back up before editing.** Use the Safe Config Editing Workflow below for any `openclaw.json` change — never batch-write the whole file.
- **Read-only investigation is fine without asking** (status commands, log tailing, config validation, grepping docs).
- **Agent sessions and workspaces may contain user conversations, prompts, and PII.** Listing them (names, timestamps, sizes, file paths) is fine without asking. Before reading the *contents* of any file under `~/.openclaw/agents/<id>/sessions/` or an agent workspace, ask the user first — explain what you're looking for and why so they can approve, narrow the scope, or point you at the right session (they may not know which one without your help). Never quote or summarize session bodies in external fetches, cross-agent messages, or any destination outside this conversation, even after approval.

## Key Paths

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

- deleting agents, sessions, plugins, or cron jobs
  - any `rm`, `mv`, or destructive git/systemd action touching OpenClaw state
- **Back up before editing.** Use the Safe Config Editing Workflow below for any `openclaw.json` change — never batch-write the whole file.
- **Read-only investigation is fine without asking** (status commands, log tailing, config validation, grepping docs).
- **Agent sessions and workspaces may contain user conversations, prompts, and PII.** Listing them (names, timestamps, sizes, file paths) is fine without asking. Before reading the *contents* of any file under `~/.openclaw/agents/<id>/sessions/` or an agent workspace, ask the user first — explain what you're looking for and why so they can approve, narrow the scope, or point you at the right session (they may not know which one without your help). Never quote or summarize session bodies in external fetches, cross-agent messages, or any destination outside this conversation, even after approval.

## Key Paths

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

md

## Safe Config Editing Workflow

> **AI Agent Warning**: NEVER batch-write the entire `openclaw.json` file. Always read, backup, edit individual keys, and validate. Overwriting the whole file is the #1 cause of catastrophic config loss. Use `openclaw config set <key> <value>` for individual changes when possible.

1. **Read** current config: `cat ~/.openclaw/openclaw.json` or `openclaw config get <key>`
2. **Backup**: `cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak-$(date +%Y%m%d-%H%M%S)`

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.

md

### Gateway & Config

**AI agents destroying config**: Never batch-write the entire `openclaw.json` file. Always backup first, edit individual keys, and validate after each change. This is the #1 cause of catastrophic config loss.

**Systemd crash loop**: `Restart=always` + invalid config = infinite restart loop (one case hit 18,000 restarts). Systemd can't distinguish "crashed" from "config validation failure." Consider adding `StartLimitBurst`/`StartLimitIntervalSec` to the service unit.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file states that scripts/refresh-openclaw-docs.sh downloads content from https://docs.openclaw.ai/llms.txt and linked pages into a local cache. While the behavior is described functionally, it does not clearly warn users that invoking the script performs network requests and writes fetched data to disk, which are safety-relevant behaviors for a skill description.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · update-failure-patterns.md (reported line 470)May include surrounding context.

md

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

Static analysis

No suspicious patterns detected.