Business API Recorder

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:38 PM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it records complete browser API traffic in a way that can expose secrets and business data without enough safeguards.

Install only if you are authorized to monitor the target application and can keep the captured logs private. Avoid production or sensitive accounts where possible, do not share generated logs with an AI system or commit them to source control until Authorization, Cookie, tokens, personal data, and confidential payloads are removed. Prefer verified installation steps over the documented curl-to-shell command.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:55
• Finding: Unverified Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `README.md:55-58` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Install via official installer curl -sSL https://install.openclaw.ai | sh ``` ### Technical Analysis The installation instructions download a mutable response from an external server and immediately execute it with `sh`. There is no version pinning, cryptographic signature verification, checksum validation, or opportunity to inspect the downloaded artifact before execution. Although HTTPS protects the connection in transit under normal conditions, it does not make the remote script immutable or independently verify its contents. A compromise of the installer host, DNS, CDN, certificate trust chain, or publishing process could replace the reviewed installer with arbitrary shell commands. This execution channel is not necessary for the Skill's core API-recording functionality. A versioned and integrity-verified installation method would provide the required dependency without granting an external endpoint the ability to choose code at installation time. ### Attack Path 1. An attacker compromises the installer endpoint or its delivery infrastructure. 2. The attacker modifies the response from `https://install.openclaw.ai`. 3. A user follows the documented Quick Start command. 4. `curl` downloads the attacker-controlled response. 5. The shell executes the response immediately under the invoking user's account. 6. The payload can access or modify any resources available to that account and may install additional components. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the installer. The resulting scope may include local source code, browser profiles, OpenClaw configuration and tokens, SSH credentials, user-owned files, and any systems accessible through the user's existing credentials. If the com ...[truncated 90 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern. 2. Distribute a versioned installer or package through a verified package repository. 3. Pin the exact audited version rather than requesting the latest release. 4. Publish a SHA-256 digest or cryptographic signature through an independent trusted channel. 5. Download the artifact to disk, verify its integrity and signer, and only then execute it. 6. Document the permissions and files modified by the installer. 7. Where a script remains necessary, provide instructions such as: ```bash curl -fSLo openclaw-installer.sh "https://example.invalid/releases/v1.2.3/install.sh" echo "<EXPECTED_SHA256> openclaw-installer.sh" | sha256sum -c - less openclaw-installer.sh sh openclaw-installer.sh ``` The placeholder URL, version, and digest must be replaced with independently verified official release information. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/network-monitor.js:40
• Finding: Unrestricted Capture and Export of Sensitive Browser Traffic<![CDATA[ ## Vulnerability Details **File Location**: `scripts/network-monitor.js:40-46, 73-81, 120-131, 151-159` **Vulnerability Type**: Plaintext collection of credentials and confidential application data **Risk Level**: High ### Vulnerable Code ```javascript const requestRecord = logRequest('fetch_request', { requestId: requestId, method: options.method || 'GET', url: url instanceof Request ? url.url : url.toString(), headers: options.headers || {}, body: options.body || null, bodyType: typeof options.body }); ``` ```javascript logRequest('fetch_response', { requestId: requestId, url: requestRecord.url, status: response.status, statusText: response.statusText, headers: Object.fromEntries(response.headers.entries()), body: responseBody, duration: endTime - startTime }); ``` ```javascript logRequest('xhr_request', { requestId: xhrData.id, method: xhrData.method, url: xhrData.url, headers: xhrData.headers, body: body, bodyType: typeof body }); ``` ```javascript logRequest('xhr_response', { requestId: xhrData.id, url: xhrData.url, status: xhr.status, statusText: xhr.statusText, headers: {}, body: responseBody, duration: endTime - xhrData.startTime }); ``` ### Technical Analysis The monitor records request URLs, request headers, request bodies, response headers, and response bodies without field-level filtering or redaction. These values can include bearer tokens, API keys, session identifiers, passwords, CSRF tokens, personal information, financial records, internal business data, and URL query-string secrets. The 5,000-character limit elsewhere in the fetch handler only applies when response text cannot be parsed as JSON. Parsed JSON values and XHR response bodies are retained without a size limit. The request array also has no total entry or memory limit. Capturing representative API schemas and business behavior is consistent with the declared fu ...[truncated 1891 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use an explicit allowlist of approved origins, URL paths, methods, and content types. 2. Redact sensitive request and response fields before storage, including: - `Authorization` - `Cookie` and `Set-Cookie` - API keys and session identifiers - passwords, access tokens, refresh tokens, and CSRF tokens - application-specific PII and confidential fields 3. Strip or redact sensitive query parameters from recorded URLs. 4. Capture schemas, field names, data types, and representative sanitized samples instead of complete production values. 5. Require explicit user confirmation identifying the target origin and recording scope before injection. 6. Add strict per-body, per-record, record-count, and total-byte limits for both JSON and text responses. 7. Do not capture binary bodies by default. 8. Encrypt exported logs at rest and apply restrictive file permissions. 9. Display a clear warning that logs must be reviewed and sanitized before being supplied to an AI system or included in documentation. 10. Provide automatic secret scanning before export and reject exports containing recognized credentials. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/network-monitor.js:9
• Finding: Captured Network Logs Are Exposed Through Page-Global Objects<![CDATA[ ## Vulnerability Details **File Location**: `scripts/network-monitor.js:9-13, 25-26, 169-181` **Vulnerability Type**: Insecure exposure of sensitive monitoring data to page scripts **Risk Level**: Medium ### Vulnerable Code ```javascript window.__OPENCLAW_NETWORK_LOG__ = { requests: [], startTime: new Date().toISOString(), pageUrl: window.location.href }; ``` ```javascript window.__OPENCLAW_NETWORK_LOG__.requests.push(record); console.log('[OpenClaw Network]', type, data.url || data.method, record); ``` ```javascript window.__openclaw_getNetworkLog = function() { return window.__OPENCLAW_NETWORK_LOG__; }; // 清空记录 window.__openclaw_clearNetworkLog = function() { window.__OPENCLAW_NETWORK_LOG__ = { requests: [], startTime: new Date().toISOString(), pageUrl: window.location.href }; }; ``` ### Technical Analysis The complete captured traffic log is stored as a mutable property of the page's `window` object. Any first-party, third-party, injected, or compromised script executing in the same page context can read, modify, clear, or replace the log. Individual raw records are also sent to the browser console. This design has no trust boundary between the monitoring component and application scripts. It enables unauthorized access to captured traffic and allows log poisoning, where malicious page code modifies the data before it is exported and used to generate implementation documentation. Storing sensitive records in an extension's isolated execution context or protected extension storage would satisfy the recording function while avoiding exposure through the page-global namespace. ### Attack Path 1. The monitor is injected into an authenticated application. 2. It records sensitive API requests and responses in `window.__OPENCLAW_NETWORK_LOG__`. 3. A compromised analytics library, malicious third-party script, or existing cross-site scripting payload reads the global object. 4. The page script ext ...[truncated 826 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store captured records in an extension-isolated world or extension background/service-worker context rather than on `window`. 2. Transfer events through narrowly scoped, authenticated extension messaging. 3. Validate message origin, tab identity, target origin, message type, and payload size. 4. Return only sanitized, read-only copies to the export workflow. 5. Do not expose raw log getter or mutation functions to page scripts. 6. Remove raw record logging from the console or log only non-sensitive metadata in an explicit debug mode. 7. Protect log integrity with sequence numbers or authenticated hashes if records cross trust boundaries. 8. Clear sensitive records automatically when recording stops, the tab navigates, or the configured retention period expires. ]]>

T08 · Insecure Dependencies

Warning

• Location: package.json:20
• Finding: Unbounded and Unlocked Third-Party Dependency Versions<![CDATA[ ## Vulnerability Details **File Location**: `package.json:20-23` **Vulnerability Type**: Insecure dependency and supply-chain configuration **Risk Level**: Medium ### Vulnerable Code ```json "dependencies": { "openclaw": ">=1.0.0", "chrome-extension": ">=1.0.0" } ``` ### Technical Analysis Both dependencies use open-ended ranges that accept every future release at or above version `1.0.0`, including future major versions. The project contains no lockfile or integrity metadata in the supplied files, so dependency resolution is not reproducible. The generic `chrome-extension` package name is also not demonstrably tied to the extension installation source described in the README. The reviewed code does not import either package directly, making it unclear whether these package dependencies are necessary or whether they are only capability declarations represented in the wrong field. An unintended, compromised, or malicious future release could introduce installation lifecycle scripts or runtime behavior that was not present during review. This finding does not establish that the current packages are malicious; it identifies an unsafe mechanism for selecting future dependency code. ### Attack Path 1. A dependency maintainer account or package registry entry is compromised, or an unintended package identity is used. 2. A malicious release is published with a version satisfying `>=1.0.0`. 3. A user or automated environment installs the project without a trusted lockfile. 4. The package manager selects the new release. 5. Malicious lifecycle or runtime code executes with the permissions of the installation process. 6. The dependency can access user-owned files, environment variables, project data, and network resources available to that process. ### Impact Assessment Successful exploitation may provide code execution with the privileges of the user installing or running the dependencies. The affected scope may include the project workspace, lo ...[truncated 237 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Verify the official registry identity, publisher, and provenance of each dependency. 2. Pin each dependency to an exact audited version. 3. Generate and commit the package manager's lockfile with integrity hashes. 4. Use deterministic installation commands that enforce the lockfile. 5. Remove dependencies that are not imported or otherwise required by the implementation. 6. Do not represent browser capabilities or externally installed extensions as package dependencies unless they are genuine packages required at runtime. 7. Review package lifecycle scripts before installation and disable them where they are unnecessary. 8. Enable dependency provenance verification, vulnerability scanning, and automated review of version updates. 9. Treat major-version upgrades as explicit security review events rather than allowing them through an open-ended range. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (17)

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Install via official installer
curl -sSL https://install.openclaw.ai | sh

# Or visit https://docs.openclaw.ai for detailed instructions
```

• Confidence: 98% confidence
• Finding: The README instructs users to execute a remote installer directly via curl piped to sh, which grants immediate shell execution to whatever content the remote server returns at that moment. If the distribution server, DNS, TLS termination, or hosted script is compromised, users can suffer full arbitrary code execution on their machine.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install via official installer
curl -sSL https://install.openclaw.ai | sh

# Or visit https://docs.openclaw.ai for detailed instructions
```

• Confidence: 97% confidence
• Finding: The explicit command chaining of network retrieval into shell execution removes any inspection boundary and amplifies the risk of executing malicious or tampered content. In the context of a developer tool that already requests powerful browser and exec capabilities, this pattern is especially dangerous because users are likely to run it on privileged workstations.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The code silently captures sensitive request and response contents without any user-facing disclosure, consent flow, or visible indication. In context, this is more dangerous because the stated purpose is generic network monitoring, but the implementation collects complete content that users and site operators would reasonably expect to remain confined to the original application flow.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The XMLHttpRequest hooks duplicate the same risky behavior for XHR by globally logging request headers, bodies, and response contents. This broad interception increases coverage across legacy and modern apps alike, making accidental or malicious exposure of sensitive traffic more likely.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The template title and core instruction require document generation in Chinese, and there is no indication that the user may choose another language or locale. This is a natural-language policy concern because it imposes a fixed language by default rather than offering an explicit opt-in or documented justification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README promotes browser API interception and request/response logging but does not warn that captured traffic may include credentials, session tokens, personal data, or proprietary business information. In a tool explicitly designed to monitor live application traffic, omission of data-handling warnings increases the risk that users will collect and retain sensitive data unsafely.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The quick-start directs users to export full API logs and generate output artifacts without noting that those files can contain authentication headers, cookies, PII, and confidential payloads. Because the skill's main output is saved documentation and logs, this omission materially increases the chance of sensitive-data leakage to disk, version control, or downstream AI systems.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly promises to capture complete API request/response logs, packet-capture samples, and real interface data, but provides no warning or safeguards about credentials, session tokens, personal data, or confidential business records that may be collected and reproduced in generated documentation. In this context, the omission is dangerous because the stated purpose is to analyze internal office systems and produce reusable artifacts for AI-driven reconstruction, which materially increases the chance of broad sensitive-data exposure beyond the original system.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The package description is written entirely in Chinese and presents the skill's purpose only in that language, with no indication that users may choose another language or that the skill is region-specific. This creates a natural-language policy concern because it effectively imposes a locale/language constraint without opt-in or documented justification.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The manifest requests an 'exec' capability even though the stated purpose is browser API interception and documentation generation, which normally only needs browser/network access and file output. Granting command-execution authority unnecessarily expands the attack surface and would allow arbitrary local process execution if the skill or one of its dependencies is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Captured network data is stored on window and exposed through globally accessible helper functions, so any other script running in the page context can read the intercepted traffic. If third-party scripts, ads, compromised dependencies, or injected XSS execute on the page, they can trivially harvest the full network log.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script intercepts all fetch traffic and records full URLs, headers, request bodies, and response bodies into a global log. This can capture credentials, session tokens, API keys, PII, and sensitive business data well beyond what is needed for basic diagnostics, creating a powerful in-page surveillance and data exposure mechanism.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The natural-language instructions and descriptions are entirely in Chinese, which can constitute a language/locale policy issue when no user opt-in or alternative is offered. The file does not state that the skill is region-specific or otherwise justify the fixed language choice.

Unverifiable Dependency: openclaw has 16 known advisory(ies) (CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-32064 (OpenClaw's andbox browser noVNC observer lacked VNC authentication); CVE-2026-32006 (OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallbac) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The dependency on 'openclaw' is specified as '>=1.0.0', which permits installation of a wide range of versions and makes it impossible to verify whether known vulnerable releases are excluded. In combination with a package that also requests powerful capabilities, an unpinned dependency increases supply-chain risk and may expose users to known flaws in whatever version resolves at install time.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The script contains user-facing natural-language strings and comments in Chinese, including the file description and operational comments, while the error message is in English. This indicates an implicit language choice without user opt-in or a documented locale-specific justification, which matches the language/locale policy category.

Intent-Code Divergence

Low

• Confidence: 79% confidence
• Finding: The file header describes this as a 'network monitoring script', but the implemented behavior is simply to locate and print the contents of another JavaScript file. The inline comment on L13 further frames the action as outputting script content for injection, which diverges from the apparent monitoring/recording label and the code's actual passive file-read behavior.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The file comments and console-facing instructional messages are written in Chinese, including operational guidance shown at runtime. This can violate language/locale policy when a skill forces a specific language without user opt-in or justification.

Static analysis

No suspicious patterns detected.