EasyClaw Config Migration

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:27 PM UTC
• Version: 0.1.0

Overview

This migration skill is mostly aligned with its purpose, but it can expose gateway tokens in output and create extra plaintext config backups, so it should be reviewed before use.

Use this only if you are comfortable with it reading EasyClaw/OpenClaw configuration files and modifying OpenClaw settings. Before running `--apply`, patch or review the merge script so token values are redacted in all output and backups are created with owner-only permissions; avoid sharing dry-run logs and rotate any gateway token that may already have appeared in output.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/merge_easyclaw_config.py:76

Finding

Authentication Tokens Are Disclosed in Migration Output

Content

View full analysis

{new!r}') ``` ### Technical Analysis The migration list explicitly includes `gateway.auth.token`. When that value differs between the source and target configurations, the script adds the original and replacement values to `changes`. Lines 76–78 then print both values using their raw `repr` representations. No path-sensitive redaction is applied before the values are written to standard output. This behavior affects both dry-run and `--apply` execution. It also conflicts with the sensitive-data handling requirement in `SKILL.md`, which directs the Skill to redact tokens, secrets, and authentication blobs. Although the reporting script contains a redaction function, that protection is not reused by the migration script. ### Attack Path 1. An EasyClaw bridge configuration contains a `gateway.auth.token`. 2. The active OpenClaw configuration either contains a different token or does not contain the field. 3. A user or Agent runs the documented command: ```bash python3 scripts/merge_easyclaw_config.py ``` or: ```bash python3 scripts/merge_easyclaw_config.py --apply ``` 4. The script prints the existing and replacement token values in plaintext. 5. An attacker with access to the terminal transcript, Agent conversation, CI output, centralized logs, or captured process output retrieves the token. 6. If the t ...[truncated 679 chars]

Remediation

View remediation

-> ') ``` 3. Introduce a shared redaction function and apply it to every diagnostic, dry-run, error, and success output path. 4. Prefer an explicit sensitive-path allowlist because field-name substring matching can miss unusually named credentials. 5. Add automated tests verifying that known token values never appear in captured standard output or standard error during dry-run and apply operations. 6. Rotate any gateway tokens that may already have been exposed through prior migration logs. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/merge_easyclaw_config.py:86

Finding

Secret-Bearing Configuration Backups May Be Created with Permissive Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The merge behavior largely matches: it compares a source config to ~/.openclaw/openclaw.json, performs a selective merge of predefined settings, supports dry-run versus apply, and creates a backup before writing. However, the description claims it locates EasyClaw desktop/runtime config files and can be used when a user asks where EasyClaw stores its config. The code does neither: it only expects a preexisting hardcoded bridge file ~/.openclaw/easyclaw.json and exits if that file is missing. That is a material mismatch in resource access and capability, even though the core merge/apply logic is aligned.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code is a reporting script, not a migration tool. It loads JSON from the EasyClaw desktop config, a bridge config at ~/.openclaw/easyclaw.json, and the OpenClaw config, then prints existence status, redacted contents, and selected field comparisons. This aligns partially with the 'where is config stored' and 'migration report' portions of the description, but the core declared purpose emphasizes safely generating or applying a selective merge into OpenClaw. No file writes, merge computation artifact, backup handling, or config application occur. Therefore the description materially overstates the skill's capabilities and primary purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill instructs reading and modifying user configuration files, including applying merges and creating backups, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where a host system or reviewer cannot clearly constrain file read/write behavior, increasing the chance of unintended file access or modification.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

text

Behavior:
- create a timestamped backup of `~/.openclaw/openclaw.json`
- merge only supported fields from `~/.openclaw/easyclaw.json`
- print changed paths

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/merge_easyclaw_config.py (reported line 52)May include surrounding context.

python

def main() -> int:
    parser = argparse.ArgumentParser(description='Merge supported EasyClaw settings into OpenClaw config.')
    parser.add_argument('--apply', action='store_true', help='Write changes to ~/.openclaw/openclaw.json')
    args = parser.parse_args()

    if not BRIDGE_CFG.exists():

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The document references app.language as a desktop-only field to be reported, which encodes a user language/locale preference. Because the guidance treats this setting as part of migration/reporting behavior without any indication of user choice or opt-in, it may conflict with language/locale policy expectations that user language preferences should not be imposed or handled without explicit user control.

Content

No source excerpt is available for this finding.