OpenClaw Quickstart Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:02 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent OpenClaw setup guide, but it recommends persistent main-session automations and sensitive communication integrations without enough scoping or user-control safeguards.

Review this carefully before installing. Use pinned, verified OpenClaw and skill versions; avoid granting broad mailbox, calendar, or messaging access until you understand each integration's permissions; prefer read-only and revocable credentials; do not enable the main-session cron examples unless you add approval, isolation, auditing, and a clear way to disable them.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:127

Finding

Persistent Autonomous Heartbeat Executes Mutable Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 127-138
Vulnerability Type: Persistent scheduled execution using mutable task instructions
Risk Level: High

Vulnerable Code:

json

{
  "cron": [{
    "name": "heartbeat",
    "schedule": {"kind": "every", "everyMs": 1800000},
    "sessionTarget": "main",
    "payload": {"kind": "systemEvent", "text": "HEARTBEAT: Read HEARTBEAT.md. Execute priority tasks."}
  }]
}

Technical Analysis

This configuration creates a recurring task that survives the initial skill setup and executes every 30 minutes. The task injects a systemEvent into the main agent session and instructs the agent to read HEARTBEAT.md and execute the tasks defined there.

Because HEARTBEAT.md is mutable and no validation, integrity check, task allowlist, or approval boundary is specified, modifying that file can change the behavior of every subsequent heartbeat without changing the reviewed skill. Execution in the main session may also expose the scheduled task to the session's existing tools, integrations, credentials, and context.

Attack Path

1. A user follows the setup instructions and registers the heartbeat cron entry.
2. An attacker, compromised skill, or other process obtains write access to HEARTBEAT.md.
3. The attacker adds unauthorized instructions to the file.
4. At the next scheduled interval, the system event directs the agent to read the modified file.
5. The agent may execute the injected tasks using tools and integrations available to the main session.
6. The behavior repeats every 30 minutes until the cron job or malicious instructions are removed.

Impact Assessment

Successful exploitation could provide recurring, cross-session influence over agent actions. The obtainable scope depends on the main session's configured capabilities and may include access to connected messaging, email, calendar, files, or other enabled tools. This ...[truncated 132 chars]

Remediation

View remediation

Remediation Suggestions

• Do not enable the recurring heartbeat by default; make it an explicit opt-in feature.
• Require interactive approval before executing tasks loaded from a mutable file.
• Run scheduled tasks in a restricted, isolated session rather than the main session.
• Replace free-form Markdown instructions with a validated task schema and an explicit allowlist of permitted operations.
• Apply strict file ownership and permissions to HEARTBEAT.md.
• Verify the file's integrity or trusted signature before processing it.
• Restrict scheduled sessions to the minimum required tools and credentials.
• Document how to inspect, pause, and permanently remove the heartbeat cron entry.
• Record each scheduled action in an auditable log without storing sensitive content unnecessarily.

T06 · System Persistence

Error

• Location: SKILL.md:107

Finding

Persistent Daily Job Accesses Sensitive Email and Calendar Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 107-118
Vulnerability Type: Persistent scheduled access to sensitive external services
Risk Level: High

Vulnerable Code:

json

{
  "cron": [{
    "name": "daily-brief",
    "schedule": {"kind": "cron", "expr": "0 8 * * *", "tz": "UTC"},
    "sessionTarget": "main",
    "payload": {"kind": "systemEvent", "text": "DAILY BRIEF: Check email, calendar, weather. Summarize priorities."}
  }]
}

Technical Analysis

The configuration registers a persistent daily task in the main session and directs the agent to access email and calendar information. These services commonly contain private communications, meeting details, contacts, links, and other sensitive data.

The documented workflow does not require approval for each run, define data minimization rules, isolate the scheduled task, or specify narrowly scoped read-only permissions. Running in the main session can also combine sensitive service access with other tools and accumulated session context. If the session, an integration, or relevant instructions are compromised, the unattended workflow may access or process sensitive information outside the user's immediate supervision.

Attack Path

1. The user connects email and calendar services and enables the daily cron entry.
2. The task executes unattended in the main session at the configured time.
3. A compromised integration, poisoned session context, or malicious message influences how the scheduled workflow processes data.
4. The workflow accesses private email or calendar content using the permissions already granted to the agent.
5. Sensitive details may be included in generated summaries, retained in session history, or exposed to another connected service.

Impact Assessment

Exploitation could expose the email and calendar information available through connected accounts. The scope is bounded by the integration's aut ...[truncated 298 chars]

Remediation

View remediation

Remediation Suggestions

• Make the daily workflow explicitly opt-in and clearly disclose the data it will access.
• Require user confirmation before each access to email or calendar content.
• Execute the workflow in an isolated session with no unrelated tools.
• Use read-only OAuth scopes and restrict access to only the required mailbox folders, calendars, and fields.
• Prevent messages and calendar content from being treated as trusted agent instructions.
• Sanitize summaries and avoid persisting message bodies, attachments, access tokens, or unnecessary personal data.
• Apply output controls so summaries cannot be sent to external channels without separate authorization.
• Provide controls to inspect, pause, and delete the scheduled job.
• Maintain an audit log identifying what data was accessed and where the resulting summary was delivered.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Global Installation of the OpenClaw Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-24
Vulnerability Type: Unpinned globally installed dependency
Risk Level: Medium

Vulnerable Code:

bash

npm i -g openclaw
openclaw init

Technical Analysis

The installation command resolves the current package published under the openclaw name rather than an exact reviewed version. It does not specify an integrity digest, trusted registry, provenance requirement, or lockfile. The package's effective content can therefore change after this skill has been audited.

npm packages and transitive dependencies may execute lifecycle scripts during installation. A compromised maintainer account, malicious release, dependency compromise, or registry substitution could consequently introduce code that executes with the invoking user's permissions. Global installation also places the resulting executable in a broadly accessible command path and increases its effect on the user's environment.

Attack Path

1. An attacker compromises the package publisher, a transitive dependency, or the package distribution channel.
2. The attacker publishes a malicious release under the package name resolved by npm.
3. A user runs npm i -g openclaw as documented.
4. npm downloads the mutable release and its dependencies.
5. Malicious lifecycle code may execute during installation, or the installed openclaw executable may perform malicious actions when openclaw init is invoked.

Impact Assessment

Malicious package code would execute with the privileges of the user running npm. Depending on those privileges, it could access user files, environment variables, locally stored credentials, network resources, and configuration files. If the command is run with administrative privileges, the impact could extend to system-wide files and globally installed tools.

Remediation

View remediation

Remediation Suggestions

• Pin an exact reviewed package version rather than installing the latest release.
• Record and verify the package's integrity digest and provenance.
• Specify the expected trusted npm registry and publisher identity.
• Review the package and its transitive dependency tree before installation.
• Prefer a project-local installation with a committed lockfile over global installation.
• Run installation under a dedicated low-privilege account and avoid sudo.
• Consider disabling lifecycle scripts during initial acquisition and enabling only reviewed scripts when required.
• Establish a controlled update process in which new versions are reviewed before deployment.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:85

Finding

Unpinned Installation of Third-Party Skills with Access to Communications

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 85-125
Vulnerability Type: Unverified third-party skill dependencies
Risk Level: Medium

Vulnerable Code:

bash

openclaw skills install wacli

bash

# Install Maton skill for Gmail/Outlook access
openclaw skills install maton

Technical Analysis

The instructions install the wacli and maton skills by mutable package name without an exact version, content digest, verified source repository, publisher identity, signature, or permission review. The first skill participates in WhatsApp QR-code pairing, while the second is intended to access Gmail or Outlook, making the trust placed in these dependencies security-sensitive.

If a named skill, its publisher, or its distribution channel is compromised, a malicious update or substituted package could be installed after the containing SKILL.md has been reviewed. This recommendation is also inconsistent with the document's later warning that skills should be verified before installation.

Attack Path

1. An attacker compromises a named skill's publisher account or distribution channel, or substitutes a malicious package with the resolved name.
2. The user executes one of the documented installation commands.
3. OpenClaw retrieves and enables the mutable third-party skill.
4. The user pairs WhatsApp or authorizes Gmail/Outlook as instructed.
5. The malicious skill uses the permissions and credentials granted through those integrations to access communications or perform unauthorized actions.

Impact Assessment

The potential scope includes WhatsApp session data and the email information exposed through Gmail or Outlook authorization. Depending on the permissions requested by the installed skills, a compromise could expose messages, contacts, attachments, authentication material, or the ability to act through connected accounts. The exact privileges cannot be established from ` ...[truncated 121 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each skill to an immutable, reviewed version or content digest.
• Identify the exact trusted publisher and canonical source repository.
• Verify signatures, checksums, and package provenance before installation.
• Review each skill's source code and transitive dependencies before granting credentials.
• Display and approve a complete permission manifest before enabling a skill.
• Use minimum-scope, revocable credentials and read-only permissions wherever possible.
• Isolate each communication integration from unrelated agent tools and sessions.
• Document how to revoke WhatsApp pairing, OAuth grants, tokens, and installed skills.
• Remove direct installation recommendations until the referenced releases have been independently verified.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to install and use an Email Triage workflow via Maton for Gmail/Outlook access, but it does not clearly warn that this enables automated access to and processing of potentially sensitive email content. That omission can cause users to authorize broad mailbox access without understanding privacy, data handling, or misrouting risks, especially in a production automation setup.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.