OpenClaw Security Audit

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:13 AM UTC
• Version: 1.1.0

Overview

This prompt-only skill performs a disclosed OpenClaw configuration audit and optional hardening, with sensitive actions mostly scoped and user-confirmed.

Install from a reviewed, pinned package version when possible. Before running hardening, expect the skill to read OpenClaw configuration that may contain secrets, create a backup, edit security settings, chmod the config directory/file, and restart the Gateway after you choose a plan.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:6

Finding

Unpinned npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 6–8
Vulnerability Type: Supply-chain risk from a mutable dependency reference
Risk Level: Medium

Vulnerable Code

bash

openclaw skills install npm:guomeiqing-security-audit

Technical Analysis

The documented installation command references an npm package without an exact version or integrity digest. The package version resolved at installation time can therefore differ from the artifact reviewed during this audit.

If the package publisher account, npm package, or release process is compromised, a malicious new version could replace or alter the prompt instructions and potentially add executable content. Users following the documentation would install that unaudited version.

The reviewed artifact itself contains only documentation and prompt instructions; no embedded malicious scripts were found. This finding concerns the mutability and lack of integrity guarantees in the documented installation method.

Attack Path

1. An attacker compromises the npm publisher account or package release pipeline.
2. The attacker publishes a malicious version under guomeiqing-security-audit.
3. A user executes the installation command from the README.
4. npm resolves the mutable package reference to the malicious version.
5. OpenClaw installs content that differs from the version reviewed here.
6. The malicious package could manipulate Skill instructions or abuse tools available to the agent, subject to the permissions granted in the victim's environment.

Impact Assessment

Successful exploitation could allow attacker-controlled Skill content to operate with the tools and permissions granted to the OpenClaw agent. Depending on the substituted package and local configuration, potential consequences include unauthorized configuration access, file modification, command execution, credential exposure, or Gateway disruption.

No such malicious payload exists in the audited project fil ...[truncated 92 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installation command to an exact, reviewed package version:

   bash

   openclaw skills install npm:guomeiqing-security-audit@X.Y.Z
   

2. Publish and document the expected npm integrity digest, and verify it during installation where supported.

3. Avoid version ranges, distribution tags such as latest, and other mutable references for security-sensitive Skills.

4. Protect package publication with phishing-resistant multi-factor authentication, narrowly scoped automation tokens, and provenance-enabled releases.

5. Ensure the pinned package archive is compared with the reviewed source artifact before release.

6. Advise users to review package contents and requested capabilities before granting access to read, edit, or exec tools.

T08 · Insecure Dependencies

Warning

• Location: README.en.md:6

Finding

Unpinned npm Package Installation in English Documentation

Content

View full analysis

Vulnerability Details

File Location: README.en.md, lines 6–8
Vulnerability Type: Supply-chain risk from a mutable dependency reference
Risk Level: Medium

Vulnerable Code

bash

openclaw skills install npm:guomeiqing-security-audit

Technical Analysis

The English installation documentation also uses an npm package reference without an exact version or integrity digest. Consequently, the package retrieved by a future user is not guaranteed to match the four files examined during this audit.

An attacker who gains package-publishing control could release altered prompt instructions or executable content. The unpinned command would then resolve to the attacker-controlled release. This is a duplicate manifestation of the same supply-chain weakness in a separate user-facing installation path.

Attack Path

1. An attacker obtains access to the package publisher account or release pipeline.
2. A modified release is published to npm.
3. A user follows the English README and runs the documented command.
4. The package manager resolves the unversioned reference to the modified release.
5. The unreviewed Skill is installed and receives whatever agent capabilities the user subsequently grants it.

Impact Assessment

The maximum impact depends on the malicious replacement package and the permissions available to the agent. Because the Skill's declared workflow uses sensitive tools such as configuration reads, file edits, and command execution, a substituted package could potentially abuse those capabilities to access or alter local data and configuration.

The audited files contain no confirmed malicious implementation, remote payload retrieval, persistence mechanism, or credential-exfiltration logic. The risk arises from installing mutable remote content rather than from a payload present in this artifact.

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable package reference with an exact reviewed version:

   bash

   openclaw skills install npm:guomeiqing-security-audit@X.Y.Z
   

2. Provide an integrity hash or signed release provenance and require verification before installation.

3. Keep the pinned version synchronized across both README files.

4. Use protected npm publishing credentials, phishing-resistant multi-factor authentication, and restricted release automation.

5. Establish a release process that confirms the published npm archive exactly matches the audited source.

6. Require explicit user review before enabling sensitive tools for an installed Skill.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (21)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.en.md (reported line 48)May include surrounding context.

md

- No FAIL but some WARN → overall WARN
- All PASS → overall PASS

**FAIL Impact:** `dmPolicy: open` means anyone on the internet can send messages to your Agent and receive responses. If the Agent also has tool permissions (e.g., exec, read/write), attackers can read your files, execute commands, and steal API Keys. This is the most severe security risk.

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that the agent will 'automatically apply config changes' and use exec to back up configs and restart the Gateway, but it does not present a clear upfront warning about service-impacting or configuration-modifying behavior. Users may invoke the skill expecting a passive audit and unintentionally authorize disruptive changes, which is especially risky for security tooling that appears informational by name.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases include very generic requests such as "安全检查", "security check", and "安全扫描", which can easily overlap with normal conversational requests. This can cause the skill to activate unexpectedly and lead the agent into reading configuration files, editing settings, or preparing restart actions in situations where the user did not clearly intend to invoke this specific high-impact skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README states that the agent can back up configuration, modify configuration items, and restart the Gateway automatically, but it does not prominently warn users that these are system-impacting actions. In a prompt-only skill, vague documentation around privileged tool use is dangerous because users may invoke the skill expecting a report, while the agent proceeds into operational changes that affect availability or security posture.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises very broad trigger phrases such as 'security check', 'security audit', and 'harden my setup', which can cause it to activate in situations where the user did not clearly intend configuration inspection or system modification guidance. In this skill, unintended activation is more dangerous because later steps instruct reading sensitive config files, checking permissions, backing up secrets-bearing files, editing configuration, and restarting services.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.en.md (reported line 131)May include surrounding context.

md

- If only the default agent has full permissions, other agents are restricted → **PASS**
- If all agents have fine-grained permissions (role-based) → **PASS**

**FAIL Impact:** When `dmPolicy: open` is combined with `tools.profile: full`, attackers can make the Agent execute arbitrary commands through chat — equivalent to giving a stranger root shell on your machine.

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill includes concrete system-changing instructions such as backing up config files, editing security-sensitive JSON, changing file permissions, restarting the gateway, and validating the modified config, but it does not provide an upfront warning near the beginning that the workflow can alter local state and service availability. This raises the risk of users or downstream agents entering a destructive or service-disruptive path without fully understanding the side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction at L008 is written as a direct behavioral requirement in Chinese and sets the skill's operational flow in that language, while the trigger list includes English phrases such as "security check" and "security audit". This creates a locale/language policy issue because the skill appears to force Chinese interaction without offering the user a language choice or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.en.md (reported line 291)May include surrounding context.

md

- 影响: 访问 Gateway API 需要 Bearer token

3. **文件权限** → chmod 收紧
   - 命令: `chmod 700 ~/.openclaw && chmod 600 ~/.openclaw/openclaw.json`
   - 影响: 无功能影响，纯安全加固

### 🟡 标准加固（约 10 分钟）

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

md

- 影响: 访问 Gateway API 需要 Bearer token

3. **文件权限** → chmod 收紧
   - 命令: `chmod 700 ~/.openclaw && chmod 600 ~/.openclaw/openclaw.json`
   - 影响: 无功能影响，纯安全加固

### 🟡 标准加固（约 10 分钟）

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.en.md (reported line 291)May include surrounding context.

md

- 影响: 访问 Gateway API 需要 Bearer token

3. **文件权限** → chmod 收紧
   - 命令: `chmod 700 ~/.openclaw && chmod 600 ~/.openclaw/openclaw.json`
   - 影响: 无功能影响，纯安全加固

### 🟡 标准加固（约 10 分钟）

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

md

- 影响: 访问 Gateway API 需要 Bearer token

3. **文件权限** → chmod 收紧
   - 命令: `chmod 700 ~/.openclaw && chmod 600 ~/.openclaw/openclaw.json`
   - 影响: 无功能影响，纯安全加固

### 🟡 标准加固（约 10 分钟）

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L445 says no modifications should occur before the user confirms, but Step 4.1 performs cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak..., which writes a new file and therefore modifies the filesystem. This is an active contradiction between the documented intent and the prescribed behavior.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.en.md (reported line 412)May include surrounding context.

示例 — 修改文件权限：

bash

chmod 700 ~/.openclaw
chmod 600 ~/.openclaw/openclaw.json

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 412)May include surrounding context.

示例 — 修改文件权限：

bash

chmod 700 ~/.openclaw
chmod 600 ~/.openclaw/openclaw.json

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.en.md (reported line 413)May include surrounding context.

示例 — 修改文件权限：

bash

chmod 700 ~/.openclaw
chmod 600 ~/.openclaw/openclaw.json

4.3 重启 Gateway

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 413)May include surrounding context.

示例 — 修改文件权限：

bash

chmod 700 ~/.openclaw
chmod 600 ~/.openclaw/openclaw.json

4.3 重启 Gateway

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill goes beyond analysis and guided editing by instructing the agent to restart the OpenClaw gateway after changes. Service-control actions can disrupt availability, apply unsafe edits immediately, and expand the agent's operational authority beyond what is necessary for a security audit workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The English README presents invocation phrases that include Chinese commands such as "安全检查" and "帮我做个安全审计" alongside English, but it does not explain language options or whether users may choose their preferred locale. This can be read as imposing or privileging a specific language without explicit opt-in or locale guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The README presents the skill description in Chinese and frames usage as speaking Chinese phrases to the agent, while not explicitly offering the user a language or locale choice. Although one English trigger phrase appears later, the overall documentation does not clearly indicate multilingual support or user opt-in for language preference.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.en.md (reported line 410)May include surrounding context.

},

text

**Example — Modify file permissions:**
```bash
chmod 700 ~/.openclaw
chmod 600 ~/.openclaw/openclaw.json

Static analysis

No suspicious patterns detected.