ClawHub
Back to skill

Security audit

Config Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent OpenClaw configuration-monitoring guide, but it recommends persistent scheduled execution of an unbundled local script and includes an unsafe backup-deletion command.

Review the local scripts before using this skill, especially config-monitor.sh and config-change-logger.sh. Only add the cron jobs if you intentionally want persistent monitoring, and make sure you know how to list and remove them. Do not run the backup cleanup command as written unless you first inspect the candidate files and replace it with a safer deletion flow.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Warning
Location
SKILL.md:92
Finding

Persistent Scheduled Execution of an Unverified External Script

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 92-103
Vulnerability Type: Persistent scheduled task referencing code outside the audited package
Risk Level: Medium

Complete Code Snippet:

bash
openclaw cron add \
  --name "Configuration Health Daily Report" \
  --cron "0 9 * * *" \
  --message "~/.openclaw/workspace/scripts/config-monitor.sh report" \
  --tz "Asia/Shanghai"

openclaw cron add \
  --name "Gateway Status Check" \
  --cron "0 * * * *" \
  --message "openclaw gateway status" \
  --tz "Asia/Shanghai"

The job names above are English renderings of the original labels; command paths, schedules, arguments, and behavior are unchanged.

Technical Analysis

The instructions create scheduled jobs that survive the current skill invocation. The daily job references ~/.openclaw/workspace/scripts/config-monitor.sh, but that script is not included in the audited project. Consequently, its implementation, ownership, permissions, and integrity cannot be verified from this package.

Scheduling a mutable external path creates a persistent execution channel. If another local process or account can create or modify the referenced script before or after registration, its content may execute each day through the OpenClaw scheduler. The instructions do not require an ownership check, permission validation, cryptographic integrity check, least-privilege execution context, or explicit user confirmation. They also provide no corresponding removal procedure.

The hourly Gateway status job has a smaller attack surface because it invokes an OpenClaw command rather than the missing script. Nevertheless, both jobs introduce persistent state and should be registered only with informed operator approval.

Attack Path

  1. An attacker obtains write access to ~/.openclaw/workspace/scripts/ or pre-creates config-monitor.sh at the referenced path.
  2. The attacker places arbitrary shell comm ...[truncated 1104 chars]
Remediation
View remediation

Remediation Suggestions

  1. Include config-monitor.sh in the audited package rather than referencing an unreviewed external implementation.
  2. Resolve the script to a fixed absolute path controlled by the skill installation process.
  3. Verify file ownership and reject scripts writable by other users or untrusted processes.
  4. Record and validate a cryptographic digest before scheduled execution.
  5. Require explicit operator confirmation before creating each persistent job.
  6. Execute monitoring with a dedicated least-privileged account that cannot modify critical configuration.
  7. Document commands for listing, disabling, and removing the scheduled jobs.
  8. Prevent duplicate job registration and clearly identify the job owner and expected output destination.
  9. Prefer a scheduler mechanism that invokes a structured, allow-listed operation rather than interpreting a free-form command message.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:200
Finding

Unsafe Backup Deletion Through ls and xargs

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 200
Vulnerability Type: Unsafe filename handling in a destructive shell pipeline
Risk Level: Medium

Complete Code Snippet:

bash
ls -t ~/.openclaw/backups/config/openclaw.json.* | tail -n +11 | xargs rm

Technical Analysis

The cleanup command parses human-oriented ls output and passes it to xargs, which splits input on whitespace and treats the resulting tokens as arguments to rm. Filenames containing spaces, tabs, quotes, backslashes, or newline characters may therefore be split or transformed. A filename that becomes an option-like argument may also affect rm because the command does not use the -- end-of-options marker.

The operation is destructive and has no dry-run mode, confirmation step, path validation, or error handling. It also assumes the textual ordering and formatting emitted by ls can safely represent filesystem paths, which is not valid for arbitrary Unix filenames.

Attack Path

  1. An attacker or faulty process with write access to the backup directory creates matching filenames containing whitespace, newline characters, or option-like components.
  2. An operator runs the documented cleanup pipeline.
  3. ls emits the filenames as text.
  4. xargs reparses that text into arguments that may not correspond to the original paths.
  5. rm receives unintended or malformed arguments and deletes files other than the intended old backup set, subject to filesystem permissions.

Exploitation requires the ability to create or rename entries in the backup directory, or the accidental presence of filenames that the pipeline cannot safely represent.

Impact Assessment

The direct impact is deletion or corruption of backup retention state. This can remove recovery points and impair restoration after a configuration failure. Depending on the malformed arguments produced and the invoking account's permissions, unintended ...[truncated 248 chars]

Remediation
View remediation

Remediation Suggestions

  1. Move backup rotation into an audited script rather than publishing an ad hoc destructive pipeline.
  2. Process paths with null delimiters, avoiding ls parsing and whitespace-based xargs.
  3. Pass -- before all filenames supplied to rm.
  4. Resolve each candidate path and verify that it remains inside the expected backup directory.
  5. Reject symbolic links and unexpected file types where they are not required.
  6. Add a dry-run mode that displays the exact files selected for removal.
  7. Require confirmation before deletion, or use a controlled retention policy with transaction logging.
  8. Preserve a minimum verified recovery set and test backup readability before removing older copies.
  9. Use restrictive ownership and directory permissions so untrusted users cannot create crafted backup filenames.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The pipeline ls -t ... | tail -n +11 | xargs rm chains file enumeration directly into deletion, which is unsafe and fragile. It can delete unintended files if path parsing behaves unexpectedly, if filenames contain whitespace/special characters, or if glob expansion matches more than intended; in a backup-management context, this directly endangers recovery assets.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

ls -lh ~/.openclaw/backups/config/

3. 考虑清理过期备份（保留最近 10 个）

ls -t ~/.openclaw/backups/config/openclaw.json.* | tail -n +11 | xargs rm

text

---

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill description and operating instructions are entirely in Chinese, with no indication that users may choose another language or locale. Per the policy, forcing a specific language without explicit user opt-in is a natural-language policy violation unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill includes a destructive cleanup command that deletes backup files without an explicit warning, confirmation step, or safer deletion mechanism. In an operational recovery/monitoring skill, silent backup deletion is risky because a user may run it verbatim and remove needed recovery points, weakening resilience and causing data loss during later incidents.

Content

No source excerpt is available for this finding.