agentar

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:25 PM UTC
• Version: 1.0.0

Overview

This skill has a coherent backup and migration purpose, but it can import untrusted packages that persistently replace agent instructions, install bundled skills, and merge configuration.

Install only if you trust the source and understand that importing a .claw package can change your OpenClaw personality, prompts, configuration, and installed skills. Avoid importing packages from arbitrary URLs unless you can verify the publisher and package hash, and review dry-run output, workspace diffs, bundled skills, and config changes before approving installation or merge steps.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: ``` This will output something like: ``` Creating backup before install... Backup created: 20260308-143022 (12 files) Rollback with: clawctl rollback 20260308-143022 ``` Tell the user the backup id and reassure them they can rollback at any time. **Step 5 — Post-install intelligence** This is where AI adds the most value. The `load` command already handles: - Auto-backup before install (with rollback id) - Workspace file installation - **Bundled skill installation** (skills packaged in the .claw a ...[truncated 2882 chars]:149
• Finding: Untrusted Claw Packages Can Replace Agent Instructions and Install Bundled Skills<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 149–170 **Vulnerability Type**: Untrusted instruction replacement and dependency installation **Risk Level**: High ### Vulnerable Code Snippet ```markdown **Step 4 — Install (with auto-backup)** The load command automatically creates a backup before installing: ```bash node {baseDir}/scripts/clawctl.mjs load <file> ``` This will output something like: ``` Creating backup before install... Backup created: 20260308-143022 (12 files) Rollback with: clawctl rollback 20260308-143022 ``` Tell the user the backup id and reassure them they can rollback at any time. **Step 5 — Post-install intelligence** This is where AI adds the most value. The `load` command already handles: - Auto-backup before install (with rollback id) - Workspace file installation - **Bundled skill installation** (skills packaged in the .claw are auto-installed to `~/.openclaw/skills/`) - Existing skill version comparison (skips if same or newer version already installed) ``` The exported workspace content is described at `SKILL.md`, lines 286–290: ```markdown ## What Gets Exported - Workspace files (system prompt, agent personality, custom instructions) - Sanitized configuration (credentials replaced with `$CLAW_PLACEHOLDER`) - **All user-installed skills** from `~/.openclaw/skills/` (full files, auto-installed on import) ``` ### Technical Analysis The documented import process installs workspace files containing system prompts, personality definitions, and custom instructions. It also automatically installs complete bundled Skills into the local OpenClaw Skill directory. The workflow requires a dry-run, but the documented preview only presents package metadata, file names, credentials, and required Skills. It does not require: - Cryptographic package signature verification - Trusted-publisher or provenance validation - Inspection of imported instruction content - Static analysis of bundled Skill code - Ar ...[truncated 1659 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require cryptographically signed `.claw` packages and verify signatures against explicitly trusted publishers. 2. Display full diffs for all imported system prompts, personality files, custom instructions, and configuration changes before installation. 3. Require separate, explicit confirmation for: - Replacing workspace instruction files - Installing each bundled Skill - Modifying configuration 4. Disable bundled Skill installation by default and provide an explicit opt-in flag. 5. Statically inspect bundled Skill manifests, instructions, and scripts before installation. 6. Reject absolute paths, `..` path traversal, device files, hard links, and symbolic links during archive extraction. 7. Extract into an isolated temporary directory, validate all content, and only then atomically copy approved files to the target. 8. Record publisher identity and package hashes in the preview and installation log. 9. Consider running imported Skills in a sandbox with restricted filesystem, network, process, and credential access. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:277
• Finding: Remote Claw Packages Are Downloaded Without Integrity or Trust Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 277 **Vulnerability Type**: Unverified remote payload retrieval **Risk Level**: High ### Vulnerable Code Snippet ```markdown - **User provides a URL instead of a file path**: Download the file first with `curl -o /tmp/downloaded.claw <url>`, then proceed with import. ``` ### Technical Analysis The Skill directs the Agent to download a package from any user-provided URL and then continue with the import workflow. No controls are specified for: - HTTPS enforcement - Certificate or publisher pinning - Cryptographic signatures - Expected hashes - Trusted-domain restrictions - Redirect validation - Download size limits - Content-type validation - Unique and securely created temporary files Because imported `.claw` packages may replace workspace instructions and automatically install bundled Skills, an unverified remote download forms a remote payload delivery channel. The effective package can also change after the Skill itself has been reviewed. The fixed path `/tmp/downloaded.claw` additionally creates a potential local race or symlink risk in multi-user environments, depending on how `curl` and the subsequent import are invoked. ### Attack Path 1. An attacker supplies a URL for a malicious or attacker-controlled `.claw` package. 2. The Agent executes `curl -o /tmp/downloaded.claw <url>`. 3. The server returns malicious content, redirects to another location, or changes the package after prior review. 4. No signature or expected digest is checked. 5. The Agent proceeds with the normal import workflow. 6. The package replaces workspace instructions or installs bundled Skills. 7. The attacker-controlled content affects future Agent behavior or executes through an imported Skill. A local attacker may alternatively attempt to manipulate the predictable `/tmp/downloaded.claw` path before import if filesystem permissions and timing permit. ### Impact Assessment A remote attacker controllin ...[truncated 429 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Accept only HTTPS URLs and reject insecure schemes, embedded credentials, local-file schemes, and unexpected redirects. 2. Require a trusted digital signature or a user-supplied expected SHA-256 digest before importing a remote package. 3. Apply an allowlist of trusted package registries or publisher domains where practical. 4. Set strict download size and timeout limits. 5. Validate the response status, final URL, content type, and package format before processing it. 6. Download into a private temporary directory created with secure operating-system APIs rather than using a predictable fixed path. 7. Open temporary files with exclusive creation and restrictive permissions, and prevent symlink following. 8. Keep remote package retrieval separate from installation and require explicit user approval after verification and content review. 9. Never automatically install bundled Skills from a remotely downloaded package. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: --dry-run ``` ```bash node {baseDir}/scripts/clawctl.mjs load <file> ``` ```bash clawhub install <skill-name> --workdir ~/.openclaw ``` ```markdown curl -o /tmp/downloaded.claw <url> ``` ### Technical Analysis The Skill presents shell command templates containing values derived from users, imported package metadata, local identity files, or remote URLs. The following fields may be attacker-influenced: - `<ref>` - `<path>` - `<desc>` - `<file>` - `<skill-name>` - `<url>` Most placeholders are unquoted ...[truncated 1972 chars]:100
• Finding: Shell Command Templates Interpolate Untrusted Values Without Safe Argument Handling<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 100, 134, 149, 183, and 277 **Vulnerability Type**: Shell command injection and unsafe temporary-file handling **Risk Level**: Medium ### Vulnerable Code Snippet ```bash node {baseDir}/scripts/clawctl.mjs save <ref> -o <path> --description "<desc>" ``` ```bash node {baseDir}/scripts/clawctl.mjs load <file> --dry-run ``` ```bash node {baseDir}/scripts/clawctl.mjs load <file> ``` ```bash clawhub install <skill-name> --workdir ~/.openclaw ``` ```markdown curl -o /tmp/downloaded.claw <url> ``` ### Technical Analysis The Skill presents shell command templates containing values derived from users, imported package metadata, local identity files, or remote URLs. The following fields may be attacker-influenced: - `<ref>` - `<path>` - `<desc>` - `<file>` - `<skill-name>` - `<url>` Most placeholders are unquoted. Although `<desc>` is enclosed in double quotes, double quotes do not safely neutralize embedded quotation marks, command substitutions, backticks, or certain shell expansions when a command is assembled as a string. If an Agent substitutes these values into a shell command and executes it through a shell, metacharacters such as `;`, `&&`, `|`, `$()`, backticks, redirections, or embedded quotes may alter the intended command. Values beginning with `-` may also be interpreted as command-line options unless option termination and validation are used. This issue is present in the documented execution pattern. Whether exploitation occurs in practice depends on how the Agent's command tool handles arguments and whether it invokes a shell. ### Attack Path 1. An attacker controls or influences a file path, package description, package reference, Skill name, or URL. 2. The value contains shell syntax, such as a command substitution or command separator. 3. The Agent directly substitutes the value into one of the documented command templates. 4. The resulting string is executed by a shell ...[truncated 761 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct shell command strings by interpolation. 2. Invoke executables through APIs that accept an argument array, with shell processing disabled. For example, pass the executable and each argument as separate values. 3. Apply strict allowlists: - Package references should follow a documented namespace/name/tag grammar. - Skill names should contain only expected alphanumeric characters, hyphens, and approved separators. - URLs should be parsed with a URL library and restricted to approved schemes. 4. Canonicalize and validate filesystem paths before use. 5. Reject control characters, null bytes, and unexpected newline characters in every externally influenced field. 6. Use `--` to terminate command options where supported, while recognizing that this is not a substitute for argument-array execution. 7. Treat descriptions and metadata strictly as data and never reinsert them into shell source. 8. Replace the fixed `/tmp/downloaded.claw` path with a securely generated temporary file in a private directory. 9. Add tests using values containing spaces, quotes, semicolons, substitutions, leading hyphens, and newlines to verify that they remain single literal arguments. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- **User wants to export + share in one step**: After export, suggest easy transfer methods (AirDrop, scp, cloud drive).
- **Multiple .claw files**: If the user says "install all claw packages", iterate through them one by one with preview for each.
- **Rollback chain**: Each rollback creates a safety backup, so the user can always undo a rollback. Explain this when asked.
- **Disk space**: If the user has many backups, suggest cleaning old ones: `rm -rf ~/.openclaw/.agentar-backups/<old-id>`.

## What Gets Exported

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- **User wants to export + share in one step**: After export, suggest easy transfer methods (AirDrop, scp, cloud drive).
- **Multiple .claw files**: If the user says "install all claw packages", iterate through them one by one with preview for each.
- **Rollback chain**: Each rollback creates a safety backup, so the user can always undo a rollback. Explain this when asked.
- **Disk space**: If the user has many backups, suggest cleaning old ones: `rm -rf ~/.openclaw/.agentar-backups/<old-id>`.

## What Gets Exported

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- **User wants to export + share in one step**: After export, suggest easy transfer methods (AirDrop, scp, cloud drive).
- **Multiple .claw files**: If the user says "install all claw packages", iterate through them one by one with preview for each.
- **Rollback chain**: Each rollback creates a safety backup, so the user can always undo a rollback. Explain this when asked.
- **Disk space**: If the user has many backups, suggest cleaning old ones: `rm -rf ~/.openclaw/.agentar-backups/<old-id>`.

## What Gets Exported

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Session Persistence

Medium

• Category: Rogue Agent

Content

node {baseDir}/scripts/clawctl.mjs backup [--source <path>] [--label <text>]
```

Create a snapshot of current workspace + config. Stored in `~/.openclaw/.agentar-backups/<id>/`.

### List Backups

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The post-install workflow authorizes installing additional skills from ClawHub after import, going beyond simple package migration into acquisition and execution of new code. Because imported packages can influence which 'missing' skills are suggested, this can create an indirect supply-chain path for bringing in unreviewed third-party capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The documented workflow reads, merges, and rewrites the live openclaw.json configuration after import, which exceeds straightforward package loading and grants the skill authority to persist configuration changes. Even with a note about keeping current credentials, merging imported settings can alter model providers, channels, or skill configuration in ways that weaken security or redirect future agent behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

> New items to merge: [list]
   > Shall I merge the non-sensitive settings?

   If the user agrees, read both JSON files, merge intelligently (keep current credentials, add new non-sensitive settings), and write back to `openclaw.json`.

3. **Credential checklist** — For each `$CLAW_PLACEHOLDER` in the imported config, tell the user exactly what they need to set:

• Confidence: 72% confidence
• Finding: The workflow explicitly instructs the agent to persist imported settings by writing back to openclaw.json, creating durable changes to future agent behavior and environment configuration. Unlike transient inspection, this is persistent state modification driven by imported package data and therefore raises security concerns if the imported config is malicious or misleading.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: Using a broad trigger like 'rollback' or 'undo import' risks activating a destructive restore workflow from normal conversation without strong intent verification. Because rollback overwrites workspace and configuration state, accidental triggering could replace the user's current agent setup even if a safety backup exists.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The underspecified trigger '导出' is broad enough to match casual conversation and could initiate data-gathering or export preparation without sufficiently clear user intent. In this skill's context, export touches workspace metadata and may produce a shareable package, so ambiguity increases the chance of unintended disclosure or unnecessary file operations.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill extends its import flow to fetch a .claw package from an arbitrary URL with curl, which changes the trust boundary from local user-supplied files to remote content acquisition. That enables social-engineered or attacker-controlled package delivery and increases risk of importing malicious workspace content, bundled skills, or hostile configuration into the user's OpenClaw environment.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions tell the agent to download a package from any user-provided URL without embedding any safety warning, trust check, or provenance validation. This normalizes retrieval of untrusted remote content and can directly feed malicious packages into the import workflow.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:294