Openclaw Config Expert

• Outcome: Review
• Latest audit: May 28, 2026 · 10:35 AM UTC
• Version: 1.0.0

Overview

This skill mostly fits OpenClaw configuration administration, but it also enables persistent automation, service restarts, broad configuration changes, and under-disclosed model or agent prompt changes that need review before installation.

Install only if you intentionally want a powerful OpenClaw administration skill. Review scripts/knowledge_optimization.py and cron_manager.py first, avoid enabling cron setup until you approve each job, and require manual confirmation before config overwrites, plugin changes, rollback, backup deletion, or Gateway restart actions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # 停止现有 Gateway
        log("停止现有 Gateway...")
        subprocess.run(
            ["pkill", "-f", "openclaw.*gateway"],
            capture_output=True
        )

• Confidence: 84% confidence
• Finding: The script kills processes using a broad regex match, "openclaw.*gateway", without verifying the exact executable or ownership. This can terminate unintended processes whose command lines happen to match, enabling local denial of service or unsafe recovery behavior if an attacker can influence process names on the host.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 启动 Gateway
        log("启动 Gateway...")
        subprocess.Popen(
            ["openclaw", "gateway", "start"],
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL

• Confidence: 81% confidence
• Finding: Launching "openclaw" by bare command name relies on PATH resolution, so a malicious local user or compromised environment could cause execution of a rogue binary instead of the intended program. In an emergency recovery script, this is more dangerous because operators may run it with elevated privileges during incidents.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The permission optimization logic automatically expands `allowAgents` to include all agents by default and broadens access for coordinator-like agents based on weak name heuristics. In a multi-agent system, this can violate least-privilege boundaries and unintentionally enable lateral access between agents, increasing the blast radius if one agent is compromised or misconfigured.

Context-Inappropriate Capability

High

• Confidence: 89% confidence
• Finding: The skill goes beyond passive configuration validation and repair by including a helper that can kill existing Gateway processes and start new ones. In an agent skill context, this expands the skill's authority from file editing into service lifecycle control, creating a meaningful availability and integrity risk if triggered unexpectedly or used on the wrong host context.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This skill is presented as configuration management, but it also provisions persistent scheduled tasks that execute operational actions automatically. In a configuration-repair context, that broader authority is more dangerous because users may authorize config help without realizing they are installing recurring automation with lasting effects.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code installs a scheduled cleanup job whose payload contains a destructive delete command: find ~/.openclaw -name 'openclaw.json.bak.*' -mtime +30 -delete. In a skill context, automatic filesystem deletion is high risk because it can permanently remove recovery artifacts, and the natural-language payload implies shell-like execution semantics in another subsystem that may process it broadly.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script's behavior materially exceeds a configuration-management skill by creating custom model files, invoking local model builds, and rewriting an unrelated agent's system prompt. That mismatch is dangerous because operators may grant the skill broader trust than warranted, enabling unauthorized persistent changes to model behavior and local AI tooling.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill includes local subprocess execution to run ollama create, which gives it the ability to alter the host's model inventory and persist new AI behaviors. In the context of a 'config expert' skill, this is more dangerous because users may not expect arbitrary local executable invocation as part of routine configuration help.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script unconditionally rewrites the psychology-analyst agent's system_prompt with sales-influence content unrelated to generic configuration management. This is dangerous because it silently changes agent behavior in a persistent way, potentially manipulating future outputs and undermining integrity, transparency, and user expectations across sessions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly instructs the user to run `python3 cron_manager.py setup` to create scheduled Cron jobs, but it does not warn that this makes persistent system-level changes that continue running after the current session. In an agent skill context, this is dangerous because it normalizes unattended recurring execution without clear consent, review of installed entries, rollback instructions, or scope limitations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The markdown describes automatic Gateway restart after configuration changes and recommends testing `modify + restart`, but it does not clearly warn about service interruption, dropped connections, or operational impact. In a configuration-management skill, this increases risk because users may execute the workflow on a live system without understanding that availability can be affected immediately.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The routing examples and trigger phrases are broad enough to overlap with ordinary troubleshooting language, which can cause unintended invocation of configuration-changing or recovery actions. In this skill context, the danger is higher because the document explicitly ties natural-language matches to operational commands that can modify agent settings or initiate recovery flows without showing confirmation gates.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document states that natural-language messages will automatically execute configuration validation, modification, optimization, and recovery commands, but it does not warn about side effects such as service restarts, configuration drift, or accidental rollback/recovery actions. In a configuration-management skill, this omission is materially dangerous because users may believe they are asking for advice while actually triggering state-changing operations on live systems.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Broad trigger phrases like '配置', '调优', '路由', or '恢复' are likely to match ordinary conversation and cause unintended invocation of a skill that can change configs and restart services. Because this skill is operational and state-changing, accidental activation materially increases risk.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The regex routing rules are overly permissive and match common-language terms across many contexts, which can misroute unrelated user input to a powerful config-management skill or other agents. In a multi-agent system, ambiguous routing can become a privilege-escalation path by steering benign requests into components that perform file, shell, or restart actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill describes automatic rollback and Gateway restart behavior during emergency recovery without clearly requiring explicit approval or warning about service disruption. In production or shared environments, such actions can interrupt availability, revert valid changes, or overwrite current state unexpectedly.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The examples encourage direct configuration edits, optimization changes, plugin state changes, and service restarts as routine operations, but do not present safeguards for live environments. This normalizes destructive behavior and increases the chance that users or dependent agents execute high-impact changes without review.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to copy a template directly over the active OpenClaw configuration path without a prominent overwrite warning or backup step at that point. This can cause accidental loss of an existing working configuration and service disruption, especially because this skill is specifically about configuration changes and recovery, making users more likely to run the command as-is.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation tells users to export API keys into their shell environment but does not warn that these are sensitive secrets that may be exposed through shell history, process environments, screenshots, or shared terminal sessions. In a configuration-management skill, users may follow commands mechanically, so omission of secret-handling guidance increases the risk of credential leakage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The enterprise instructions require exporting several high-value credentials, including app secrets for external integrations, without any guidance on secure storage or handling. This expands the blast radius beyond a single API key: leakage could allow unauthorized access to enterprise messaging integrations and production workflows, and the skill context makes this more dangerous because it targets production and team environments.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The monthly backup cleanup job is enabled immediately and performs destructive deletion without interactive confirmation, preview, or warning. In an admin-assistant skill, this increases the chance of accidental data loss because users may invoke setup expecting maintenance recommendations, not silent activation of recurring deletion.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The apply-template flow copies a template directly over the user's active configuration file without any explicit confirmation, dry-run, or safety interlock. Although it creates a backup when the target exists, this can still cause accidental service disruption, loss of recent edits, or application of unsafe settings if the command is triggered unintentionally or with the wrong template.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The report includes ready-to-run commands that enable/disable plugins, perform migrations, and apply optimization targets, but it does not warn that these actions can change persistent configuration or service behavior. In a configuration-management skill, users are especially likely to copy commands directly, so the omission increases the risk of unintended outages, plugin state changes, or difficult-to-revert configuration drift.

Static analysis

No suspicious patterns detected.