OpenClaw Permissions Audit

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 1.0.0

Overview

This skill performs a clearly disclosed OpenClaw permissions audit and avoids exposing full secrets, but its report should still be treated as sensitive.

Install only if you want an agent to summarize your OpenClaw security posture. Do not publish or forward the generated report casually, because even without secret values it can reveal enabled providers, gateway exposure, approval rules, operator scopes, and channel access patterns.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:23

Finding

Sensitive OpenClaw Security Configuration Reconnaissance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–29 and 34–75
Vulnerability Type: Sensitive Resource Reconnaissance
Risk Level: Medium

Complete Code Snippet

markdown

### 1. Read Configuration Files

Attempt to read the following files in order. If a file does not exist, mark all its fields as `⚠️ not configured` in the report — do not silently skip it.

- `~/.openclaw/openclaw.json` — main configuration
- `~/.openclaw/exec-approvals.json` — tool execution approvals
- `~/.openclaw/identity/device-auth.json` — device authentication
- `~/.openclaw/identity/device.json` — device identity

markdown

### 2. Extract Permission Dimensions

Extract and report the following dimensions:

**A. AI Model API Access**
- From `openclaw.json → auth.profiles`, list each configured provider by name (e.g., anthropic, kimi-coding). Do not show credentials.
- From `openclaw.json → env`, list the key names of API keys only. Never show values.
- From `openclaw.json → agents.defaults.model`, show the default primary model and any configured fallbacks.

**B. Channel / Communication Access**
- From `openclaw.json → channels`, for each channel entry show:
  - enabled status
  - count of authorized user IDs plus first 4 chars of each ID (not the full ID). User IDs are nested under `channels.<channel>.guilds[guildId].users[]` — navigate to that path, not a top-level `users` key.
  - count of authorized guild/server IDs only (no partial IDs)
  - group policy (allowlist / open)

**C. Gateway Access**
- From `openclaw.json → gateway`, show:
  - port, bind address, mode
  - auth mode (token / none) — show existence only (✅/❌), not the token value
  - Tailscale enabled status
  - denyCommands list (command names are safe to show in full)

**D. Tool Execution Permissions**
- From `openclaw.json → tools.profile`, show the profile name.
- From `exec-approvals.json → agents`, list per-agent tool approval rules by agent name and rule summary.
- From `exec-
...[truncated 3586 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit confirmation before reading device-auth.json, device.json, or exec-approvals.json.
2. Make identity, authentication, and execution-approval inspection opt-in rather than part of the default audit.
3. Default to auditing only openclaw.json, with separate flags for more sensitive files.
4. Apply least-data collection by reporting only whether broad controls are configured, unless detailed output is explicitly requested.
5. Avoid displaying partial user or device identifiers unless required for disambiguation.
6. Label the generated report as security-sensitive and advise users not to publish or forward it.
7. Restrict skill invocation and report access to authenticated administrators or equivalent trusted operators.
8. Preserve the existing prohibitions against exposing tokens, API-key values, private keys, full identifiers, IPC authentication data, and expanded private paths.
9. Add automated output filtering to detect and redact credential-like strings before returning the report.
10. Maintain an audit log recording who requested access to the sensitive configuration inventory.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.