ClawHub
Back to skill

Security audit

OpenClaw Verified Upgrade

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-built for safer OpenClaw upgrades, but its bundled transaction guard has real safety-control gaps for a high-impact upgrade workflow.

Install only if you are comfortable reviewing and supervising the upgrade steps manually. Do not treat the bundled guard as fully enforcing its safety promises until the run-ID containment, backup-verification gate, and trusted stability timing issues are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/upgrade-transaction.mjs:94
Finding

Run ID Path Traversal Escapes the Transaction State Directory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/upgrade-transaction.mjs:155
Finding

Core Update Can Be Armed Without Persisted Backup Verification

Content
View full analysis
= 1) { ctx.data.reentryRefusals = (ctx.data.reentryRefusals || 0) + 1; ctx.data.lastRefusal = "UPDATE_REENTRY_DETECTED"; save(ctx); event(ctx.dir, "begin_refused", ctx.data.status); stop("Core update already began"); } if (ctx.data.status !== "PLAN_READY") stop("Run is not ready"); const current = snapshot(args); if (hash(current) !== ctx.data.fingerprint) { ctx.data.status = "PLAN_STALE"; save(ctx); event(ctx.dir, "fingerprint_refused", ctx.data.status); stop("Verified snapshot changed"); } const required = ["json", "no-restart", "tag", "yes"]; if (required.some((value) => !current.capabilities.includes(value))) { ctx.data.status = "COMMAND_CAPABILITY_UNSUPPORTED"; save(ctx); event(ctx.dir, "capability_refused", ctx.data.status); stop("Required capability is absent"); } acquire(id); ctx.data.attempts.coreUpdate = 1; ctx.data.status = "CORE_UPDATE_RUNNING"; save(ctx); event(ctx.dir, "core_armed", ctx.data.status); const command = [current.cliPath, "update", "--tag", ctx.data.target, "--no-restart", "--yes", "--json"]; process.stdout.write(JSON.stringify({ ok: true, runId: id, status: ctx.data.status, command }, null, 2) + "\n"); } ``` The missing check conflicts with the documented hard invariant in `SKILL.md`: ```md 6. No verified backup, no core mutation. ``` ### Technical Analysis The transaction manifest created by `plan()` does not contain a backup-verification gate. There is also no guard command that records an archive digest, size, manifest read-back result, o ...[truncated 2024 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/upgrade-transaction.mjs:287
Finding

Caller-Controlled Observation Timestamps Permit Fabricated Stability Completion

Content
View full analysis
Date.parse(a.at) - Date.parse(b.at)); if (ctx.data.observations.length > 20) ctx.data.observations = ctx.data.observations.slice(-20); save(ctx); event(ctx.dir, "observe", ctx.data.status); process.stdout.write(JSON.stringify({ ok: true, runId: ctx.data.runId, observationCount: ctx.data.observations.length }, null, 2) + "\n"); } function stability(data) { const samples = data.observations || []; if (samples.length < 3) return { pass: false, reason: "need-at-least-three-samples" }; const first = samples[0]; const last = samples[samples.length - 1]; const spanSeconds = (Date.parse(last.at) - Date.parse(first. ...[truncated 3225 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
9. Use at most one service reconciliation action per approval. Never chain install, start, and restart.
10. A ready line is not completion; require repeated stability checks.
11. Failure freezes mutation. Preserve evidence and obtain separate approval for recovery or rollback.
12. Never auto-delete state, sessions, migration sources, databases, plugins, skills, credentials, or service definitions.
13. Never use sudo for user-level service repair.
14. Never claim success without fresh evidence.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill defines operational behavior that relies on environment/code capabilities but does not declare an explicit tool scope such as permissions or allowed-tools. In an agent system, this creates ambiguity about what the skill may access at runtime, increasing the risk of unintended environment exposure or over-broad tool use during an upgrade workflow.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
10. A ready line is not completion; require repeated stability checks.
11. Failure freezes mutation. Preserve evidence and obtain separate approval for recovery or rollback.
12. Never auto-delete state, sessions, migration sources, databases, plugins, skills, credentials, or service definitions.
13. Never use sudo for user-level service repair.
14. Never claim success without fresh evidence.

## Modes

Session Persistence

Medium
Category
Rogue Agent
Confidence
55% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · examples/test-prompts.json (reported line 25)May include surrounding context.

json
{
    "id": "resume",
    "prompt": "The agent restarted during the upgrade. Continue.",
    "expected": "Read persisted state, call resume, preserve budgets, and never create a replacement run to bypass refusal."
  }
]

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/recovery-contract.md (reported line 15)May include surrounding context.

md
## Deferred Automation

This Skill intentionally does not embed a subprocess runner, temporary LaunchAgent, systemd unit, restart loop, migration renamer, installer, or rollback executor. Those host mutations require current command discovery, action-specific approval, bounded execution, and separate safety review.

Do not claim a full unattended Harness. Use the transaction guard with supervised execution until an independently reviewed coordinator satisfies those controls.

Static analysis

No suspicious patterns detected.