agentar

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:25 PM UTC
• Version: 1.0.0

Overview

This skill has a coherent backup and migration purpose, but it can import untrusted packages that persistently replace agent instructions, install bundled skills, and merge configuration.

Install only if you trust the source and understand that importing a .claw package can change your OpenClaw personality, prompts, configuration, and installed skills. Avoid importing packages from arbitrary URLs unless you can verify the publisher and package hash, and review dry-run output, workspace diffs, bundled skills, and config changes before approving installation or merge steps.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: ``` This will output something like: ``` Creating backup before install... Backup created: 20260308-143022 (12 files) Rollback with: clawctl rollback 20260308-143022 ``` Tell the user the backup id and reassure them they can rollback at any time. **Step 5 — Post-install intelligence** This is where AI adds the most value. The `load` command already handles: - Auto-backup before install (with rollback id) - Workspace file installation - **Bundled skill installation** (skills packaged in the .claw a ...[truncated 2882 chars]:149

Finding

Untrusted Claw Packages Can Replace Agent Instructions and Install Bundled Skills

Content

View full analysis

``` This will output something like: ``` Creating backup before install... Backup created: 20260308-143022 (12 files) Rollback with: clawctl rollback 20260308-143022 ``` Tell the user the backup id and reassure them they can rollback at any time. **Step 5 — Post-install intelligence** This is where AI adds the most value. The `load` command already handles: - Auto-backup before install (with rollback id) - Workspace file installation - **Bundled skill installation** (skills packaged in the .claw are auto-installed to `~/.openclaw/skills/`) - Existing skill version comparison (skips if same or newer version already installed) ``` The exported workspace content is described at `SKILL.md`, lines 286–290: ```markdown ## What Gets Exported - Workspace files (system prompt, agent personality, custom instructions) - Sanitized configuration (credentials replaced with `$CLAW_PLACEHOLDER`) - **All user-installed skills** from `~/.openclaw/skills/` (full files, auto-installed on import) ``` ### Technical Analysis The documented import process installs workspace files containing system prompts, personality definitions, and custom instructions. It also automatically installs complete bundled Skills into the local OpenClaw Skill directory. The workflow requires a dry-run, but the documented preview only presents package metadata, file names, credentials, and required Skills. It does not require: - Cryptographic package signature verification - Trusted-publisher or provenance validation - Inspection of imported instruction content - Static analysis of bundled Skill code - Ar ...[truncated 1659 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:277

Finding

Remote Claw Packages Are Downloaded Without Integrity or Trust Verification

Content

View full analysis

`, then proceed with import. ``` ### Technical Analysis The Skill directs the Agent to download a package from any user-provided URL and then continue with the import workflow. No controls are specified for: - HTTPS enforcement - Certificate or publisher pinning - Cryptographic signatures - Expected hashes - Trusted-domain restrictions - Redirect validation - Download size limits - Content-type validation - Unique and securely created temporary files Because imported `.claw` packages may replace workspace instructions and automatically install bundled Skills, an unverified remote download forms a remote payload delivery channel. The effective package can also change after the Skill itself has been reviewed. The fixed path `/tmp/downloaded.claw` additionally creates a potential local race or symlink risk in multi-user environments, depending on how `curl` and the subsequent import are invoked. ### Attack Path 1. An attacker supplies a URL for a malicious or attacker-controlled `.claw` package. 2. The Agent executes `curl -o /tmp/downloaded.claw `. 3. The server returns malicious content, redirects to another location, or changes the package after prior review. 4. No signature or expected digest is checked. 5. The Agent proceeds with the normal import workflow. 6. The package replaces workspace instructions or installs bundled Skills. 7. The attacker-controlled content affects future Agent behavior or executes through an imported Skill. A local attacker may alternatively attempt to manipulate the predictable `/tmp/downloaded.claw` path before import if filesystem permissions and timing permit. ### Impact Assessment A remote attacker controllin ...[truncated 429 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: --dry-run ``` ```bash node {baseDir}/scripts/clawctl.mjs load <file> ``` ```bash clawhub install <skill-name> --workdir ~/.openclaw ``` ```markdown curl -o /tmp/downloaded.claw <url> ``` ### Technical Analysis The Skill presents shell command templates containing values derived from users, imported package metadata, local identity files, or remote URLs. The following fields may be attacker-influenced: - `<ref>` - `<path>` - `<desc>` - `<file>` - `<skill-name>` - `<url>` Most placeholders are unquoted ...[truncated 1972 chars]:100

Finding

Shell Command Templates Interpolate Untrusted Values Without Safe Argument Handling

Content

View full analysis

-o --description "" ``` ```bash node {baseDir}/scripts/clawctl.mjs load --dry-run ``` ```bash node {baseDir}/scripts/clawctl.mjs load ``` ```bash clawhub install --workdir ~/.openclaw ``` ```markdown curl -o /tmp/downloaded.claw ``` ### Technical Analysis The Skill presents shell command templates containing values derived from users, imported package metadata, local identity files, or remote URLs. The following fields may be attacker-influenced: - `` - `` - `` - `` - `` - `` Most placeholders are unquoted. Although `` is enclosed in double quotes, double quotes do not safely neutralize embedded quotation marks, command substitutions, backticks, or certain shell expansions when a command is assembled as a string. If an Agent substitutes these values into a shell command and executes it through a shell, metacharacters such as `;`, `&&`, `|`, `$()`, backticks, redirections, or embedded quotes may alter the intended command. Values beginning with `-` may also be interpreted as command-line options unless option termination and validation are used. This issue is present in the documented execution pattern. Whether exploitation occurs in practice depends on how the Agent's command tool handles arguments and whether it invokes a shell. ### Attack Path 1. An attacker controls or influences a file path, package description, package reference, Skill name, or URL. 2. The value contains shell syntax, such as a command substitution or command separator. 3. The Agent directly substitutes the value into one of the documented command templates. 4. The resulting string is executed by a shell ...[truncated 761 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.

md

- **User wants to export + share in one step**: After export, suggest easy transfer methods (AirDrop, scp, cloud drive).
- **Multiple .claw files**: If the user says "install all claw packages", iterate through them one by one with preview for each.
- **Rollback chain**: Each rollback creates a safety backup, so the user can always undo a rollback. Explain this when asked.
- **Disk space**: If the user has many backups, suggest cleaning old ones: `rm -rf ~/.openclaw/.agentar-backups/<old-id>`.

## What Gets Exported

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.

md

- **User wants to export + share in one step**: After export, suggest easy transfer methods (AirDrop, scp, cloud drive).
- **Multiple .claw files**: If the user says "install all claw packages", iterate through them one by one with preview for each.
- **Rollback chain**: Each rollback creates a safety backup, so the user can always undo a rollback. Explain this when asked.
- **Disk space**: If the user has many backups, suggest cleaning old ones: `rm -rf ~/.openclaw/.agentar-backups/<old-id>`.

## What Gets Exported

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 294)May include surrounding context.

md

- **User wants to export + share in one step**: After export, suggest easy transfer methods (AirDrop, scp, cloud drive).
- **Multiple .claw files**: If the user says "install all claw packages", iterate through them one by one with preview for each.
- **Rollback chain**: Each rollback creates a safety backup, so the user can always undo a rollback. Explain this when asked.
- **Disk space**: If the user has many backups, suggest cleaning old ones: `rm -rf ~/.openclaw/.agentar-backups/<old-id>`.

## What Gets Exported

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

node {baseDir}/scripts/clawctl.mjs backup [--source ] [--label ]

text

Create a snapshot of current workspace + config. Stored in `~/.openclaw/.agentar-backups/<id>/`.

### List Backups

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The post-install workflow authorizes installing additional skills from ClawHub after import, going beyond simple package migration into acquisition and execution of new code. Because imported packages can influence which 'missing' skills are suggested, this can create an indirect supply-chain path for bringing in unreviewed third-party capabilities.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documented workflow reads, merges, and rewrites the live openclaw.json configuration after import, which exceeds straightforward package loading and grants the skill authority to persist configuration changes. Even with a note about keeping current credentials, merging imported settings can alter model providers, channels, or skill configuration in ways that weaken security or redirect future agent behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 72% confidence

Finding

The workflow explicitly instructs the agent to persist imported settings by writing back to openclaw.json, creating durable changes to future agent behavior and environment configuration. Unlike transient inspection, this is persistent state modification driven by imported package data and therefore raises security concerns if the imported config is malicious or misleading.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md

> New items to merge: [list]
   > Shall I merge the non-sensitive settings?

   If the user agrees, read both JSON files, merge intelligently (keep current credentials, add new non-sensitive settings), and write back to `openclaw.json`.

3. **Credential checklist** — For each `$CLAW_PLACEHOLDER` in the imported config, tell the user exactly what they need to set:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Using a broad trigger like 'rollback' or 'undo import' risks activating a destructive restore workflow from normal conversation without strong intent verification. Because rollback overwrites workspace and configuration state, accidental triggering could replace the user's current agent setup even if a safety backup exists.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The underspecified trigger '导出' is broad enough to match casual conversation and could initiate data-gathering or export preparation without sufficiently clear user intent. In this skill's context, export touches workspace metadata and may produce a shareable package, so ambiguity increases the chance of unintended disclosure or unnecessary file operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill extends its import flow to fetch a .claw package from an arbitrary URL with curl, which changes the trust boundary from local user-supplied files to remote content acquisition. That enables social-engineered or attacker-controlled package delivery and increases risk of importing malicious workspace content, bundled skills, or hostile configuration into the user's OpenClaw environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions tell the agent to download a package from any user-provided URL without embedding any safety warning, trust check, or provenance validation. This normalizes retrieval of untrusted remote content and can directly feed malicious packages into the import workflow.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:294