System Health Check

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:52 PM UTC
• Version: 0.1.0

Overview

This appears to be a legitimate health-check skill, with sensitive checks disclosed and tied to its accounting-system monitoring purpose.

Install this only in the intended OpenClaw Greek Accounting environment, because it is designed to inspect sensitive accounting, auth, backup, and integrity paths. Review the sudo-based setup line before running it, and prefer installing dependencies through your normal package-management process. Saved reports, failure logs, and cron usage are disclosed, but users should confirm where reports are written and who can read them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The shell construct 'which jq openssl || sudo apt install jq openssl' chains a benign check to an automatic privileged action on failure. In an adversarial-skill model, this is dangerous because it conditions users to run root-level commands copied from untrusted content, and failure states can become a trigger for unauthorized system modification.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

bash

export OPENCLAW_DATA_DIR="/data"
which jq openssl || sudo apt install jq openssl

Read-only validation skill. Checks file presence, directory structure, permissions, and backup freshness. Never modifies any data.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md

- path: "/data/auth/"
      expected_mode: "700"
      description: "Auth directory must be restricted to service user"
    - path: "/data/auth/users/*/credentials.json"
      expected_mode: "600"
      description: "Credential files must not be world-readable"

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · EVALS.json (reported line 23)May include surrounding context.

json

"prompt": "The health check reports that /data/clients/ has permission mode 755 instead of the expected 700. What should happen?",
    "expectations": [
      "Flags this as a FAIL result, not just a warning",
      "Explains the security risk: world-readable client financial data",
      "Provides the specific remediation command: chmod 700 /data/clients/",
      "Does not automatically change the permissions — reports only",
      "Includes this failure in the JSON report output",

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md

"prompt": "The health check reports that /data/clients/ has permission mode 755 instead of the expected 700. What should happen?",
    "expectations": [
      "Flags this as a FAIL result, not just a warning",
      "Explains the security risk: world-readable client financial data",
      "Provides the specific remediation command: chmod 700 /data/clients/",
      "Does not automatically change the permissions — reports only",
      "Includes this failure in the JSON report output",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · EVALS.json (reported line 24)May include surrounding context.

json

"expectations": [
      "Flags this as a FAIL result, not just a warning",
      "Explains the security risk: world-readable client financial data",
      "Provides the specific remediation command: chmod 700 /data/clients/",
      "Does not automatically change the permissions — reports only",
      "Includes this failure in the JSON report output",
      "Suggests running the fix and then re-running the health check"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 417)May include surrounding context.

md

"expectations": [
      "Flags this as a FAIL result, not just a warning",
      "Explains the security risk: world-readable client financial data",
      "Provides the specific remediation command: chmod 700 /data/clients/",
      "Does not automatically change the permissions — reports only",
      "Includes this failure in the JSON report output",
      "Suggests running the fix and then re-running the health check"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The setup instruction encourages use of sudo to install packages directly from within the skill workflow. That normalizes privilege escalation and can cause users or agents to execute elevated commands based on untrusted skill content, increasing the blast radius if the skill is malicious, mistaken, or run in sensitive environments.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

bash

export OPENCLAW_DATA_DIR="/data"
which jq openssl || sudo apt install jq openssl

Read-only validation skill. Checks file presence, directory structure, permissions, and backup freshness. Never modifies any data.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file explicitly states 'English Output' as a fixed behavior. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is clearly justified; no such user choice or justification is provided here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.