OpenClaw Recovery (Codex)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:07 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent OpenClaw diagnostic guide, but it incorrectly labels configuration-changing repair commands as safe read-only actions.

Install only if you are comfortable with a troubleshooting skill that inspects local OpenClaw state, service status, ports, and Tailscale status. Do not let an agent run `openclaw doctor --fix` or the BOM-removal Node snippet automatically; treat them as manual config-changing actions that need approval, a backup, and path verification first.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:139

Finding

Configuration-changing recovery commands are incorrectly classified as read-only

Content

View full analysis

" ``` ``` ### Technical Analysis The Skill places `openclaw doctor --fix` under a section explicitly described as “read-only, no side effects.” The `--fix` option indicates that the command may repair and therefore modify configuration or state. The exact changes performed depend on the installed OpenClaw implementation, but it is not safe to represent a repair operation as read-only. The BOM-removal routine unambiguously modifies the selected configuration file through `fs.writeFileSync`. It overwrites the original file in place without: - Obtaining explicit user approval. - Creating a backup. - Confirming that the resolved path is the intended OpenClaw configuration. - Validating the resulting JSON before replacement. - Preserving metadata or handling concurrent writes. - Using an atomic temporary-file-and-rename operation. This discrepancy can cause an agent to execute configuration-changing operations under the mistaken assumption that they are diagnostic only. Although no direct command injection was identified in the fixed Node.js command, an incorrect, stale, or attacker-influenced configuration path could cause the same-user process to overwri ...[truncated 1543 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description promises a broad recovery and diagnostics skill for multiple OpenClaw infrastructure failure modes and all major OSes. The actual code is a single Bash environment-detection script for macOS/Linux only. It gathers basic local information such as OS, binary path, config/state locations, gateway port, and Tailscale status. It does not attempt repair/recovery, does not inspect messaging integrations, scheduled tasks, or webhook pipelines, and does not itself implement Windows support. This is a material description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Labeling openclaw doctor --fix as 'read-only, no side effects' is dangerous because operators or downstream agents may execute it without appropriate caution, backups, or change control. A command explicitly named --fix can alter configuration and system state, turning a diagnostic workflow into an unintended write operation.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

REPORT ONLY — do NOT execute these yourself

text

icacls / chmod / chown       # permission changes
schtasks /create /delete /end /change  # task modification
launchctl load/unload        # service modification
systemctl start/stop/restart # service modification
openclaw gateway stop        # kills Gateway connection

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

text

icacls / chmod / chown       # permission changes
schtasks /create /delete /end /change  # task modification
launchctl load/unload        # service modification
systemctl start/stop/restart # service modification
openclaw gateway stop        # kills Gateway connection
npm/pnpm install/update -g openclaw  # package modification

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The BOM-removal snippet directly rewrites the configuration file, but the surrounding skill framing emphasizes diagnostics and cautious recovery. That mismatch can cause an agent or operator to perform file modification in a context expected to be mostly observational, increasing risk of unintended config corruption or unauthorized changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Presenting the BOM-removal script as 'safe' without a clear warning is hazardous because it normalizes direct config editing and obscures that the command performs an in-place write. In operational environments, that can lead to accidental modification of production configuration, especially when agents are expected to avoid side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script prints values from OPENCLAW_STATE_DIR and OPENCLAW_CONFIG_PATH and, if absent, searches the user's home directory and echoes candidate config file paths. These are user-facing disclosures of filesystem and environment-derived information, but the script includes no warning, prompt, or explanatory comment indicating that it will reveal potentially sensitive local paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The script executes external commands including openclaw --version, openclaw status, and tailscale status to gather environment details. Although this is part of environment detection, there is no explicit warning or disclosure in the script comments or output that it will run installed binaries and display their status information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.