ClawHub
Back to skill

Security audit

Clawdocs Improved

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent OpenClaw documentation helper, but some bundled examples and scripts create review-worthy security risks before installation.

Install only if you are comfortable auditing the snippets before use. Replace all concrete account IDs and phone numbers with your own verified identifiers, disable elevated execution unless strictly needed, avoid the pipe-to-bash installer unless independently verified, and treat the bundled ready-to-paste configs as examples requiring security review rather than safe defaults.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:66
Finding

Unverified Remote Installer Is Piped Directly into Bash

Content
View full analysis
Remediation
View remediation
/install.sh ``` - Verify the downloaded artifact against a checksum obtained through a separately authenticated release channel. - Prefer signature verification using a documented, pinned public key. - Require users to inspect the downloaded script before executing it: ```bash less openclaw-install.sh bash openclaw-install.sh ``` - Pin documentation to a specific release rather than an unversioned, mutable installer URL. - Document the privileges and filesystem changes required by the installer. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error
Location
snippets/validated-configs.md:147
Finding

Reusable Configuration Authorizes a Hard-Coded Discord Account to Approve Execution

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
snippets/validated-configs.md:151
Finding

Ready-to-Paste Configuration Combines Open Channel Input with Broad Host and Data Access

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/fetch-doc.sh:13
Finding

Unsanitized Documentation Path Allows Writes Outside the Cache Directory

Content
View full analysis
/dev/null) if [[ "$http_code" == "200" ]] && [[ -s "$tmp" ]]; then mv "$tmp" "$cache_file" cat "$cache_file" ``` ### Technical Analysis The script treats its first argument as both a URL path and a relative filesystem path. Its only normalization is removal of one leading slash and addition of a `.md` suffix. It does not reject: - `..` parent-directory components. - Empty or repeated path components. - Backslashes on platforms where they may be separators. - URL control characters or schemes. - Paths whose canonical destination escapes `${CACHE_DOCS}`. For example, an argument such as `../../target.md` produces a cache path conceptually equivalent to: ```text ${CACHE_DOCS}/../../target.md ``` The script creates the destination directory and then moves the downloaded response into that path. Shell quoting prevents command injection but does not prevent filesystem traversal. In addition, `curl -L` follows redirects without checking that the final URL remains on the expected HTTPS documentation host. This expands the remote-content trust boundary. ### Attack Path 1. An attacker directly invokes the script or influences an agent to call it with a traversal path such as `../../target.md`. 2. The script appends no suffix because the supplied path already en ...[truncated 1257 chars]
Remediation
View remediation
&2 exit 1 fi ``` - Explicitly reject `.` and `..` components, backslashes, control characters, query strings, fragments, and URL schemes. - Canonicalize both the cache root and destination and verify confinement before writing: ```bash cache_root="$(realpath -m "$CACHE_DOCS")" destination="$(realpath -m "${CACHE_DOCS}/${path}")" case "$destination" in "$cache_root"/*) ;; *) echo "[error] Path escapes cache directory" >&2 exit 1 ;; esac ``` - Create temporary files using `mktemp` inside a trusted cache directory rather than predictable `".tmp.$$"` names. - Restrict `curl` to HTTPS and the intended host. Avoid following cross-origin redirects, or validate the effective URL after the request. - Run the scripts under a dedicated unprivileged account with no write access to agent instructions, credentials, or persistent memory. - Add automated tests covering `../`, encoded traversal, repeated separators, absolute paths, and redirect behavior. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (26)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose is documentation assistance, but the documented scripts imply broader state-changing behavior such as cache refresh, snapshotting, and filesystem management. This mismatch is dangerous because users and calling agents may trust the skill as informational while it can modify local data and persist or delete cached content.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

This is a concrete instance of external script fetching and immediate execution via curl -fsSL https://openclaw.ai/install.sh | bash. In a documentation skill, surfacing such a command materially increases the chance that an agent or user will run unverified remote code, making the context more dangerous because the skill is positioned as authoritative setup guidance.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
- Gmail → `automation/gmail-pubsub`

- **"How do I install/deploy?"** → Check `install/` or `platforms/`
  - Updating → `install/updating` (recommended: `curl -fsSL https://openclaw.ai/install.sh | bash`)

## Search Scripts

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/channels.md (reported line 588)May include surrounding context.

text

- Requires Full Disk Access **and** Automation permissions to Messages DB.
- Remote SCP requires strict host-key checking; Mac host key must exist in `~/.ssh/known_hosts`.
- iMessage has no native mention metadata; relies on regex patterns.
- Prefer `chat_id:<id>` targets. Use `imsg chats --limit 20` to list chats.
- `service`: verify if this field exists (in example but not in docs).

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/cache.sh (reported line 80)May include surrounding context.

sh
do_clear() {
  echo "Clearing all caches..."
  rm -rf "${CACHE_DIR:?}/"*
  ensure_cache_dir
  echo "Cache cleared."
}

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill advertises and references shell and network-capable scripts but does not declare any explicit tool scope or allowed-tools boundary. That creates unnecessary privilege ambiguity: an agent may invoke fetch/search/install-related shell commands without clear least-privilege constraints, increasing the chance of unintended command execution or remote content retrieval.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The decision tree lists generic prompts like "How do I set up X?", "Why isn't X working?", and "What is X?" as usage patterns. In a markdown skill description, these are broad, everyday phrases and the file does not provide exclusion conditions or narrow context to prevent unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill includes a shell-piped remote install command (curl ... | bash) as a recommended update path without any warning, integrity check, or safer alternative. This is dangerous because it encourages execution of unaudited remote code directly in a shell, exposing users to supply-chain compromise, MITM-related risk, or malicious server-side changes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/agents.md (reported line 209)May include surrounding context.

md
modelCacheDir: "~/.cache/openclaw/models",
        },
        remote: {
          baseUrl: "https://api.openai.com/v1/",
          apiKey: "${OPENAI_API_KEY}",
          headers: {},
          batch: {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The markdown notes that the integration requires Full Disk Access and access to the Messages database, which is a sensitive capability affecting private user data. While the requirement is stated, there is no direct warning describing the privacy implications or advising users to enable it only on trusted hosts handling personal message history.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/environment-providers.md (reported line 105)May include surrounding context.

md
models: {
    providers: {
      cerebras: {
        baseUrl: "https://api.cerebras.ai/v1",
        apiKey: "${CEREBRAS_API_KEY}",
        api: "openai-completions",
        models: [

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/environment-providers.md (reported line 127)May include surrounding context.

md
models: {
    providers: {
      minimax: {
        baseUrl: "https://api.minimax.io/anthropic",
        apiKey: "${MINIMAX_API_KEY}",
        api: "anthropic-messages",
        models: [{ id: "MiniMax-M2.1", name: "MiniMax M2.1" }],

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/environment-providers.md (reported line 143)May include surrounding context.

md
models: {
    providers: {
      moonshot: {
        baseUrl: "https://api.moonshot.ai/v1",
        apiKey: "${MOONSHOT_API_KEY}",
        api: "openai-completions",
        models: [{ id: "kimi-k2.5", name: "Kimi K2.5", contextWindow: 256000 }],

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/environment-providers.md (reported line 264)May include surrounding context.

md
- Channel plugin manifest: `id`, `label`, `selectionLabel`, `docsPath`, `blurb`, `order`, `aliases`, `preferOver`.
- Install manifest: `npmSpec`, `localPath`, `defaultChoice`.

**Security:** symlink/path traversal blocking, world-writable paths rejected, ownership checks, `--ignore-scripts` on install.

**CLI commands:** `openclaw plugins list`, `info`, `install`, `update`, `enable`, `disable`, `doctor`.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The browser configuration documents evaluateEnabled: true and remote CDP attachment via cdpUrl without a clear warning that these options can grant code execution in pages and access to an existing browser session. In practice, attaching to a live profile or remote debugger may expose cookies, authenticated sessions, page contents, and privileged browsing actions if misconfigured or reachable by an attacker.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation describes authenticated inbound hook endpoints that can ingest external data and trigger agent actions, including mapped agent execution and optional transform scripts, but it does not prominently warn that enabling these features exposes a remote attack surface. If users deploy the example with weak/shared tokens, public exposure, or unsafe transforms, untrusted input could drive agent behavior or reach adjacent systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation explicitly states that tailscale.mode: "funnel" is public but provides only a minimal note that auth is required, without a clear warning about internet exposure, privacy implications, and the risk of accidental deployment with weak or misconfigured authentication. In a gateway configuration reference, this omission can lead operators to expose internal services publicly without fully understanding the security boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example enables files.urlAllowlist: ["*"] and images.urlAllowlist: ["*"], which normalizes unrestricted fetching from arbitrary external URLs without warning about SSRF, data exfiltration, or access to internal network resources. Because this is shown as a reference configuration, users may copy it directly into production and unintentionally permit dangerous outbound fetch behavior.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/gateway.md (reported line 211)May include surrounding context.

md
| Flag | Behavior |
|------|----------|
| `--yes` | Auto-approve non-destructive repairs |
| `--repair` | Attempt all repairs |
| `--repair --force` | Force-repair even when uncertain |
| `--non-interactive` | Skip refresh attempts and confirmation prompts |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file documents enabling ! <cmd> for host shell execution and /config for reading/writing openclaw.json, both of which can affect system integrity or user data. While the lines describe the features, they do not include a cautionary warning about the risks or expected safeguards for users enabling them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file documents elevated host exec access and provides an example with enabled: true, but it does not include a clear warning that enabling this permits high-impact command execution on the host system. For markdown files, safety-affecting behaviors should be accompanied by warnings when they could impact system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The Web Search and Fetch section shows outbound network operations and use of ${BRAVE_API_KEY}, but does not warn that prompts, URLs, or related metadata may be sent to external providers. For markdown files, behaviors that affect privacy or transmit data should include user-facing warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The Media section documents processing of inbound audio/video and lists external providers plus local CLI execution, but it does not explicitly warn that media content, prompts, transcripts, or file paths may be exposed to third-party services or local tools. This is a privacy- and system-impacting behavior that markdown documentation should disclose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The clear action performs a recursive forced deletion of all files under the cache directory using rm -rf, which is a destructive operation. Although the script prints 'Clearing all caches...', it does not provide a user warning about irreversibility or ask for confirmation before deleting data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documented Gmail hook configuration includes includeBody: true and a messageTemplate that forwards the full email body into another channel, which can expose sensitive email contents to Discord or other recipients beyond the original mailbox. In a documentation skill that provides copy-pasteable 'validated' configs, this is especially risky because users may deploy it as-is without appreciating the privacy and data-sharing implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The markdown states that each channel starts automatically when its config section exists, but it does not explicitly warn users that simply adding configuration may immediately activate external integrations. Because channel activation can affect connected accounts and message handling, a brief warning would improve user awareness.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/agents.md:176

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/channels.md:138

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
snippets/validated-configs.md:60