Clawdocs Improved

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:32 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent OpenClaw documentation helper, but some bundled examples and scripts create review-worthy security risks before installation.

Install only if you are comfortable auditing the snippets before use. Replace all concrete account IDs and phone numbers with your own verified identifiers, disable elevated execution unless strictly needed, avoid the pipe-to-bash installer unless independently verified, and treat the bundled ready-to-paste configs as examples requiring security review rather than safe defaults.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:66
• Finding: Unverified Remote Installer Is Piped Directly into Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:66` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```markdown - **"How do I install/deploy?"** → Check `install/` or `platforms/` - Updating → `install/updating` (recommended: `curl -fsSL https://openclaw.ai/install.sh | bash`) ``` ### Technical Analysis The recommended command downloads a mutable script from an external server and passes its contents directly to Bash. The payload is not pinned to a version, saved for inspection, checked against a cryptographic digest, or verified with a trusted signature. HTTPS protects the connection in transit but does not guarantee that the remote server, hosting account, DNS configuration, or future version of the installer remains trustworthy. Because the response is executed immediately, compromise of any relevant part of the remote delivery chain results in arbitrary code execution under the privileges of the user running the command. This behavior is not required for the Skill's documentation and configuration-reference functionality. ### Attack Path 1. A user asks the Skill how to install or update OpenClaw. 2. The Skill recommends the documented `curl ... | bash` command. 3. The user executes the command. 4. The current response from `https://openclaw.ai/install.sh` is sent directly to Bash. 5. If the endpoint or its delivery chain is compromised, attacker-controlled shell commands execute without review or integrity validation. ### Impact Assessment The downloaded script receives all privileges available to the invoking user. It could potentially: - Read user-accessible credentials, configuration, and private files. - Modify OpenClaw configuration or executable files. - Install additional payloads or persistence mechanisms. - Exfiltrate local data over the network. - Obtain system-wide control if the command is run by a privileged account. The affected scope is the ho ...[truncated 65 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove all recommendations that pipe network responses directly into a shell. - Publish versioned installer artifacts with cryptographic signatures and checksums. - Instruct users to download the installer separately, for example: ```bash curl --proto '=https' --tlsv1.2 -fSLo openclaw-install.sh \ https://openclaw.ai/releases/<version>/install.sh ``` - Verify the downloaded artifact against a checksum obtained through a separately authenticated release channel. - Prefer signature verification using a documented, pinned public key. - Require users to inspect the downloaded script before executing it: ```bash less openclaw-install.sh bash openclaw-install.sh ``` - Pin documentation to a specific release rather than an unversioned, mutable installer URL. - Document the privileges and filesystem changes required by the installer. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: snippets/validated-configs.md:147
• Finding: Reusable Configuration Authorizes a Hard-Coded Discord Account to Approve Execution<![CDATA[ ## Vulnerability Details **File Location**: `snippets/validated-configs.md:147-169` and `snippets/validated-configs.md:263-264` **Vulnerability Type**: Hard-coded external principal with execution and elevated-access authorization **Risk Level**: Critical ### Vulnerable Code ```json5 { channels: { discord: { enabled: true, token: "${DISCORD_BOT_TOKEN}", groupPolicy: "open", replyToMode: "first", dmPolicy: "pairing", allowFrom: ["178012755612139520"], guilds: { "*": { requireMention: false }, }, actions: { reactions: true, messages: true, threads: true, pins: true, search: true, memberInfo: true, roleInfo: true, channelInfo: true, polls: true, stickers: true, voiceStatus: true, events: true, roles: false, moderation: false, }, execApprovals: { enabled: true, approvers: ["178012755612139520"], target: "dm", cleanupAfterResolve: true, }, }, }, } ``` The same fixed account is subsequently granted elevated access: ```json5 elevated: { enabled: true, allowFrom: { discord: ["178012755612139520"] }, }, ``` ### Technical Analysis The file is presented as containing ready-to-paste, validated configurations, but it embeds the concrete Discord account ID `178012755612139520`. That principal appears in three security-sensitive locations: - The channel sender allowlist. - The execution approval list. - The elevated host-execution allowlist. The example does not mark the value as a placeholder or direct users to replace it with their own verified Discord account ID. A user who applies the configuration unchanged may therefore grant a third-party Discord account authority over host-level execution workflows. This permission materially exceeds what is needed by a documentation Skill. It also violates least privilege because the same remote identity receives both approval authority and elevated executi ...[truncated 1290 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove every concrete user, channel, phone-number, and account identifier from reusable snippets. - Replace the Discord ID with an unmistakable placeholder, such as: ```json5 allowFrom: ["${OWNER_DISCORD_USER_ID}"] ``` - Disable execution approval and elevated access in baseline examples: ```json5 execApprovals: { enabled: false, approvers: [], } elevated: { enabled: false, allowFrom: {}, } ``` - Require users to obtain their own immutable Discord user ID and verify it locally before enabling access. - Do not grant the same principal both request and approval authority. Use separation of duties where execution approval is necessary. - Restrict approvals to narrowly defined agents, sessions, channels, and command targets. - Add an explicit warning that examples must not be pasted until all placeholder identities are replaced and verified. - Recommend running OpenClaw under a dedicated unprivileged operating-system account. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: snippets/validated-configs.md:151
• Finding: Ready-to-Paste Configuration Combines Open Channel Input with Broad Host and Data Access<![CDATA[ ## Vulnerability Details **File Location**: `snippets/validated-configs.md:151-158` and `snippets/validated-configs.md:232-264` **Vulnerability Type**: Excessive default permissions and unsafe remote-input exposure **Risk Level**: High ### Vulnerable Code The Discord example permits open group input across wildcard guilds without requiring a mention: ```json5 discord: { enabled: true, token: "${DISCORD_BOT_TOKEN}", groupPolicy: "open", replyToMode: "first", dmPolicy: "pairing", allowFrom: ["178012755612139520"], guilds: { "*": { requireMention: false }, }, ``` The tools example broadly enables process, filesystem, messaging, session, network, and elevated capabilities: ```json5 { tools: { allow: ["exec", "process", "read", "write", "edit", "message", "sessions_send", "sessions_list", "sessions_history", "sessions_spawn", "session_status"], deny: ["browser"], exec: { backgroundMs: 10000, timeoutSec: 1800, cleanupMs: 1800000, notifyOnExit: true, }, loopDetection: { enabled: true, historySize: 30, warningThreshold: 10, criticalThreshold: 20, globalCircuitBreakerThreshold: 30, detectors: { genericRepeat: true, knownPollNoProgress: true, pingPong: true, }, }, web: { search: { enabled: true, apiKey: "${BRAVE_API_KEY}" }, fetch: { enabled: true }, }, elevated: { enabled: true, allowFrom: { discord: ["178012755612139520"] }, }, }, } ``` ### Technical Analysis The examples are individually labeled as validated and ready to paste, but together they establish an unsafe trust boundary: - `groupPolicy: "open"` permits messages from groups outside a narrow allowlist. - `guilds: { "*": ... }` applies the behavior broadly. - `requireMention: false` causes ordinary channel traffic to be processed without explicit invocation. - `exec` and `process` permit comman ...[truncated 2190 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make baseline channel access restrictive: ```json5 groupPolicy: "allowlist", guilds: { "${TRUSTED_GUILD_ID}": { requireMention: true, }, }, ``` - Default to a minimal tool profile and explicitly deny dangerous capabilities: ```json5 tools: { profile: "minimal", allow: ["session_status"], deny: [ "exec", "process", "write", "edit", "apply_patch", "sessions_history", "sessions_send", "browser", "gateway", "cron" ], elevated: { enabled: false, }, } ``` - Enable tools individually only after documenting why each capability is needed. - Keep documentation agents sandboxed with no host access, no network access by default, and read-only access to bundled reference files. - Separate public-channel agents from administrative agents and their session histories. - Require explicit mentions and immutable sender identifiers. - Do not use wildcard guild, channel, media-host, or sender entries in production examples. - Add confirmation controls for commands that modify files, invoke processes, or send data externally. - Treat all inbound messages and remotely fetched documentation as untrusted content. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fetch-doc.sh:13
• Finding: Unsanitized Documentation Path Allows Writes Outside the Cache Directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fetch-doc.sh:13-36` **Vulnerability Type**: Path traversal and arbitrary writable Markdown-file overwrite **Risk Level**: High ### Vulnerable Code ```bash ensure_cache_dir # Normalize path: strip leading /, ensure .md suffix path="$1" path="${path#/}" [[ "$path" == *.md ]] || path="${path}.md" url="${DOCS_BASE}/${path}" cache_file="${CACHE_DOCS}/${path}" cache_dir="$(dirname "$cache_file")" mkdir -p "$cache_dir" # Use cache if fresh if is_fresh "$cache_file" "$CACHE_TTL"; then cat "$cache_file" exit 0 fi # Fetch with atomic write tmp="${cache_file}.tmp.$$" http_code=$(curl -sfL --max-time 30 -o "$tmp" -w '%{http_code}' "$url" 2>/dev/null) if [[ "$http_code" == "200" ]] && [[ -s "$tmp" ]]; then mv "$tmp" "$cache_file" cat "$cache_file" ``` ### Technical Analysis The script treats its first argument as both a URL path and a relative filesystem path. Its only normalization is removal of one leading slash and addition of a `.md` suffix. It does not reject: - `..` parent-directory components. - Empty or repeated path components. - Backslashes on platforms where they may be separators. - URL control characters or schemes. - Paths whose canonical destination escapes `${CACHE_DOCS}`. For example, an argument such as `../../target.md` produces a cache path conceptually equivalent to: ```text ${CACHE_DOCS}/../../target.md ``` The script creates the destination directory and then moves the downloaded response into that path. Shell quoting prevents command injection but does not prevent filesystem traversal. In addition, `curl -L` follows redirects without checking that the final URL remains on the expected HTTPS documentation host. This expands the remote-content trust boundary. ### Attack Path 1. An attacker directly invokes the script or influences an agent to call it with a traversal path such as `../../target.md`. 2. The script appends no suffix because the supplied path already en ...[truncated 1257 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Restrict accepted paths to a conservative allowlist, for example: ```bash path="${1#/}" if [[ ! "$path" =~ ^[A-Za-z0-9_-]+(/[A-Za-z0-9_-]+)*(\.md)?$ ]]; then echo "[error] Invalid documentation path" >&2 exit 1 fi ``` - Explicitly reject `.` and `..` components, backslashes, control characters, query strings, fragments, and URL schemes. - Canonicalize both the cache root and destination and verify confinement before writing: ```bash cache_root="$(realpath -m "$CACHE_DOCS")" destination="$(realpath -m "${CACHE_DOCS}/${path}")" case "$destination" in "$cache_root"/*) ;; *) echo "[error] Path escapes cache directory" >&2 exit 1 ;; esac ``` - Create temporary files using `mktemp` inside a trusted cache directory rather than predictable `".tmp.$$"` names. - Restrict `curl` to HTTPS and the intended host. Avoid following cross-origin redirects, or validate the effective URL after the request. - Run the scripts under a dedicated unprivileged account with no write access to agent instructions, credentials, or persistent memory. - Add automated tests covering `../`, encoded traversal, repeated separators, absolute paths, and redirect behavior. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is documentation assistance, but the documented scripts imply broader state-changing behavior such as cache refresh, snapshotting, and filesystem management. This mismatch is dangerous because users and calling agents may trust the skill as informational while it can modify local data and persist or delete cached content.

External Script Fetching

High

• Category: Supply Chain

Content

- Gmail → `automation/gmail-pubsub`

- **"How do I install/deploy?"** → Check `install/` or `platforms/`
  - Updating → `install/updating` (recommended: `curl -fsSL https://openclaw.ai/install.sh | bash`)

## Search Scripts

• Confidence: 97% confidence
• Finding: This is a concrete instance of external script fetching and immediate execution via `curl -fsSL https://openclaw.ai/install.sh | bash`. In a documentation skill, surfacing such a command materially increases the chance that an agent or user will run unverified remote code, making the context more dangerous because the skill is positioned as authoritative setup guidance.

Credential Access

High

• Category: Privilege Escalation

Content

```

- Requires Full Disk Access **and** Automation permissions to Messages DB.
- Remote SCP requires strict host-key checking; Mac host key must exist in `~/.ssh/known_hosts`.
- iMessage has no native mention metadata; relies on regex patterns.
- Prefer `chat_id:<id>` targets. Use `imsg chats --limit 20` to list chats.
- `service`: verify if this field exists (in example but not in docs).

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

do_clear() {
  echo "Clearing all caches..."
  rm -rf "${CACHE_DIR:?}/"*
  ensure_cache_dir
  echo "Cache cleared."
}

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises and references shell and network-capable scripts but does not declare any explicit tool scope or allowed-tools boundary. That creates unnecessary privilege ambiguity: an agent may invoke fetch/search/install-related shell commands without clear least-privilege constraints, increasing the chance of unintended command execution or remote content retrieval.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The decision tree lists generic prompts like "How do I set up X?", "Why isn't X working?", and "What is X?" as usage patterns. In a markdown skill description, these are broad, everyday phrases and the file does not provide exclusion conditions or narrow context to prevent unintended invocation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill includes a shell-piped remote install command (`curl ... | bash`) as a recommended update path without any warning, integrity check, or safer alternative. This is dangerous because it encourages execution of unaudited remote code directly in a shell, exposing users to supply-chain compromise, MITM-related risk, or malicious server-side changes.

External Transmission

Medium

• Category: Data Exfiltration

Content

modelCacheDir: "~/.cache/openclaw/models",
        },
        remote: {
          baseUrl: "https://api.openai.com/v1/",
          apiKey: "${OPENAI_API_KEY}",
          headers: {},
          batch: {

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The markdown notes that the integration requires Full Disk Access and access to the Messages database, which is a sensitive capability affecting private user data. While the requirement is stated, there is no direct warning describing the privacy implications or advising users to enable it only on trusted hosts handling personal message history.

External Transmission

Medium

• Category: Data Exfiltration

Content

models: {
    providers: {
      cerebras: {
        baseUrl: "https://api.cerebras.ai/v1",
        apiKey: "${CEREBRAS_API_KEY}",
        api: "openai-completions",
        models: [

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

models: {
    providers: {
      minimax: {
        baseUrl: "https://api.minimax.io/anthropic",
        apiKey: "${MINIMAX_API_KEY}",
        api: "anthropic-messages",
        models: [{ id: "MiniMax-M2.1", name: "MiniMax M2.1" }],

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

models: {
    providers: {
      moonshot: {
        baseUrl: "https://api.moonshot.ai/v1",
        apiKey: "${MOONSHOT_API_KEY}",
        api: "openai-completions",
        models: [{ id: "kimi-k2.5", name: "Kimi K2.5", contextWindow: 256000 }],

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

- Channel plugin manifest: `id`, `label`, `selectionLabel`, `docsPath`, `blurb`, `order`, `aliases`, `preferOver`.
- Install manifest: `npmSpec`, `localPath`, `defaultChoice`.

**Security:** symlink/path traversal blocking, world-writable paths rejected, ownership checks, `--ignore-scripts` on install.

**CLI commands:** `openclaw plugins list`, `info`, `install`, `update`, `enable`, `disable`, `doctor`.

• Confidence: 70% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The browser configuration documents `evaluateEnabled: true` and remote CDP attachment via `cdpUrl` without a clear warning that these options can grant code execution in pages and access to an existing browser session. In practice, attaching to a live profile or remote debugger may expose cookies, authenticated sessions, page contents, and privileged browsing actions if misconfigured or reachable by an attacker.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation describes authenticated inbound hook endpoints that can ingest external data and trigger agent actions, including mapped agent execution and optional transform scripts, but it does not prominently warn that enabling these features exposes a remote attack surface. If users deploy the example with weak/shared tokens, public exposure, or unsafe transforms, untrusted input could drive agent behavior or reach adjacent systems.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly states that `tailscale.mode: "funnel"` is public but provides only a minimal note that auth is required, without a clear warning about internet exposure, privacy implications, and the risk of accidental deployment with weak or misconfigured authentication. In a gateway configuration reference, this omission can lead operators to expose internal services publicly without fully understanding the security boundary.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The example enables `files.urlAllowlist: ["*"]` and `images.urlAllowlist: ["*"]`, which normalizes unrestricted fetching from arbitrary external URLs without warning about SSRF, data exfiltration, or access to internal network resources. Because this is shown as a reference configuration, users may copy it directly into production and unintentionally permit dangerous outbound fetch behavior.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Flag | Behavior |
|------|----------|
| `--yes` | Auto-approve non-destructive repairs |
| `--repair` | Attempt all repairs |
| `--repair --force` | Force-repair even when uncertain |
| `--non-interactive` | Skip refresh attempts and confirmation prompts |

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This markdown file documents enabling `! <cmd>` for host shell execution and `/config` for reading/writing `openclaw.json`, both of which can affect system integrity or user data. While the lines describe the features, they do not include a cautionary warning about the risks or expected safeguards for users enabling them.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This markdown file documents `elevated` host exec access and provides an example with `enabled: true`, but it does not include a clear warning that enabling this permits high-impact command execution on the host system. For markdown files, safety-affecting behaviors should be accompanied by warnings when they could impact system integrity.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The Web Search and Fetch section shows outbound network operations and use of `${BRAVE_API_KEY}`, but does not warn that prompts, URLs, or related metadata may be sent to external providers. For markdown files, behaviors that affect privacy or transmit data should include user-facing warnings.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The Media section documents processing of inbound audio/video and lists external providers plus local CLI execution, but it does not explicitly warn that media content, prompts, transcripts, or file paths may be exposed to third-party services or local tools. This is a privacy- and system-impacting behavior that markdown documentation should disclose.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The clear action performs a recursive forced deletion of all files under the cache directory using `rm -rf`, which is a destructive operation. Although the script prints 'Clearing all caches...', it does not provide a user warning about irreversibility or ask for confirmation before deleting data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documented Gmail hook configuration includes `includeBody: true` and a `messageTemplate` that forwards the full email body into another channel, which can expose sensitive email contents to Discord or other recipients beyond the original mailbox. In a documentation skill that provides copy-pasteable 'validated' configs, this is especially risky because users may deploy it as-is without appreciating the privacy and data-sharing implications.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The markdown states that each channel starts automatically when its config section exists, but it does not explicitly warn users that simply adding configuration may immediately activate external integrations. Because channel activation can affect connected accounts and message handling, a brief warning would improve user awareness.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/agents.md:176

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/channels.md:138

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: snippets/validated-configs.md:60