OpenClaw Urgent Care

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:54 AM UTC
• Version: 0.1.1

Overview

This troubleshooting skill is mostly coherent, but it recommends broad tool access and direct auth/account-state edits without enough safeguards.

Review this skill carefully before installing. Use the read-only diagnostic commands first, back up OpenClaw config and auth files before editing them, and avoid setting tools.profile to full unless you understand and can later restore the prior security profile. Treat the promoted external installer as unreviewed by this artifact unless you separately inspect its source and behavior.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:59

Finding

Recovery Guidance Enables Excessive Agent Tool Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–66
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Vulnerable code:

markdown

**Fix:**
1. Open `~/.openclaw/openclaw.json`
2. Find or add: `"tools": { "profile": "full" }`
3. Run: `openclaw gateway restart`

> ⚠️ `full` grants full tool access. Review your security posture before applying.

Technical Analysis

The recovery procedure directs the operator to replace a restricted, message-only profile with the unrestricted full tool profile. This breaks least-privilege boundaries by granting the agent access to every tool permitted by that profile, rather than restoring only the specific capabilities required for diagnosis or recovery.

The warning acknowledges that the profile provides full tool access, but the procedure does not identify a least-privilege alternative, preserve existing approval controls, limit the permission increase to a diagnostic period, or direct the operator to restore the previous profile afterward. Restarting the gateway activates the expanded permissions.

Attack Path

1. An attacker influences the agent through a malicious message, prompt injection, compromised channel, or incorrectly routed conversation.
2. The agent cannot initially perform privileged actions because its tool profile is restricted.
3. An operator follows the documented recovery procedure and changes tools.profile to full.
4. The operator restarts the gateway, activating the unrestricted tool profile.
5. Attacker-controlled instructions invoke newly available tools.
6. Depending on the tools and operating-system permissions exposed by the profile, the attacker may execute commands, access local files, alter configuration, or perform additional system actions.

Impact Assessment

Successful exploitation expands the affected agent's privileges from message-only operation to full tool ac ...[truncated 506 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the blanket full profile recommendation with a least-privilege procedure that enables only the tools required for the affected operation.
2. Require the operator to back up the current configuration and record the original profile before making changes.
3. Preserve command-approval, host, sandbox, allowlist, and confirmation controls when restoring tool access.
4. If temporary broad access is unavoidable, clearly mark it as time-limited and provide mandatory steps to restore the original restricted profile immediately after diagnosis.
5. Require explicit operator confirmation before enabling command execution, file access, credential access, or network-capable tools.
6. Recommend testing the changed profile in an isolated environment and validating channel bindings before exposing it to untrusted messages.
7. Add post-recovery verification commands that confirm the active profile and ensure that unnecessary tools are disabled.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs users to modify authentication and billing-related state files, including removing provider usage/account entries and rotating API keys, without backup, validation, or clear warnings about side effects. In a troubleshooting context this can cause account-state corruption, loss of auditability, or misconfiguration of provider access, especially if users apply it blindly during an outage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill promotes an external install script and an automated recovery tool that performs auto-fixes and writes reports, but it does not clearly disclose what files are modified, what commands are executed, or the security implications of running a shell installer. This creates a trust and transparency risk: users may execute a local script with broad filesystem access during an urgent recovery scenario without understanding the changes being made.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.