how to use openclaw

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:24 AM UTC
• Version: 1.0.2

Overview

This is a straightforward OpenClaw helper skill, but it may inspect local OpenClaw configuration, workspace notes, user context, and logs while helping.

Install this only if you are comfortable with the assistant reading relevant local OpenClaw files. For sensitive environments, ask it to inspect only the specific file or log needed and to redact secrets or personal details before summarizing anything.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:15

Finding

Overly Broad Access to Sensitive OpenClaw State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-18, 26-33, 65-66, and 73-80
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Relevant Code Snippets:

markdown

## Quick Start

Use this workflow unless the user asks for something narrower:

1. Identify the user's real goal: configuration, skills, workspace files, logs, or troubleshooting.
2. Inspect the relevant local files under `~/.openclaw/` before answering from memory.
3. Prefer concrete paths and commands over abstract explanations.
4. If a change is requested, edit the smallest possible file and then validate the result.

markdown

## Core Locations

Check these locations first on a normal local installation:

- `~/.openclaw/openclaw.json`: main configuration file
- `~/.openclaw/workspace/`: shared workspace guidance and notes
- `~/.openclaw/workspace/AGENTS.md`: project or workspace behavior rules
- `~/.openclaw/workspace/TOOLS.md`: environment-specific tool notes
- `~/.openclaw/workspace/USER.md`: user preferences and human context
- `~/.openclaw/skills/` and `~/.openclaw/workspace/skills/`: installed or in-progress skills
- `~/.openclaw/logs/`: logs for troubleshooting
- `~/.openclaw/extensions/`: installed extensions and their docs

markdown

1. Decide whether it belongs in `~/.openclaw/skills/` or the current workspace.
2. Create a folder named after the skill.

markdown

## Suggested Commands

Use fast inspection commands first:

- `rg --files "~/.openclaw"`
- `rg -n "keyword" "~/.openclaw"`
- `Get-ChildItem -Force "~/.openclaw"`
- `Get-Content -Raw "~/.openclaw/openclaw.json"`
- `Get-Content -Raw "~/.openclaw/workspace/AGENTS.md"`

Technical Analysis

The skill directs the agent to inspect a broad collection of local OpenClaw resources, including configuration, persistent workspace instructions, user-context files, logs, ext ...[truncated 2083 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user approval before reading potentially sensitive files such as openclaw.json, USER.md, AGENTS.md, or log files.
2. Apply least-privilege inspection by accessing only the specific file needed to answer the request.
3. Replace broad recursive enumeration commands with commands scoped to an explicitly identified directory or file.
4. Avoid reading complete configuration or log files when a targeted search for a known key or error is sufficient.
5. Redact credentials, tokens, personal data, internal paths, and unrelated log content before presenting or summarizing results.
6. Add an instruction prohibiting the transmission of local file contents to external services unless the user gives informed consent.
7. For modifications, show the proposed target and change to the user before writing to configuration, workspace, or skill files.
8. Document which OpenClaw files may contain secrets and ensure they are treated as sensitive by default.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

1. Map the request to one of these buckets:
   - inspect configuration
   - create or edit a skill
   - update workspace instructions
   - troubleshoot a broken setup
2. Show the exact file or command to check first.