Skill

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.dangerous_exec

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI05: Unexpected Code Execution

What this means

If the external installer or upstream project is compromised, it could change the user's local environment or agent tooling.

Why it was flagged

The Pro engine installer downloads a shell script from GitHub, executes it, and then runs a global auto-patch command. This is disclosed and related to token compression, but the provided artifacts do not show checksum/signature verification or a separate approval step before execution.

Skill content

curl -fsSL "$installer_url" -o "$tmp_installer" ... sh "$tmp_installer" ... rtk init -g --auto-patch

Recommendation

Prefer manual installation from a verified release, add checksum/signature verification, and ask the user for explicit confirmation before executing downloaded installers or global patch commands.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

The agent could act on stale or cached tool output, or a repeated command could be skipped when the user expected it to run again.

Why it was flagged

The cache hook can intercept tool calls, including selected bash commands, and return a cached result instead of letting the live tool run. Some regex-based bash allowlisting, such as all rtk commands and find, may be broader than strictly read-only behavior.

Skill content

const CACHEABLE_TOOLS = new Set(["read_file", "list_directory", "search_files", "glob", "grep", "bash"]); ... /^rtk\b/ ... return { cached: true, cachedResult: cached

Recommendation

Make command-result substitution opt-in, use stricter read-only command parsing, include workspace/session/file-state checks in cache keys, and provide a clear disable/clear-cache command.

ConcernHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Sensitive file contents or command output seen by the agent may persist in a local SQLite database and may be reused later as context.

Why it was flagged

The Pro cache stores tool results locally, including outputs from file reads, searches, grep, and some bash commands. The artifacts do not show path exclusions, secret filtering, encryption, or age-based deletion; the 4-hour check limits reuse but old entries can remain in the database until pruned by count.

Skill content

const CACHE_DB = join(OPENCLAW_DIR, "clawtk-cache.db"); ... setCache(hash, toolName, event.result); ... const MAX_CACHE_ENTRIES = 5000

Recommendation

Document exactly what is cached, exclude sensitive paths and secret-like outputs, purge expired entries, restrict file permissions, and give users an easy cache clear/disable option.

ConcernHigh Confidence

ASI10: Rogue Agents

What this means

Bash tool behavior may continue to be modified after setup and may affect future OpenClaw sessions beyond the immediate cost-optimization task.

Why it was flagged

The Engine setup installs a global PreToolUse hook that transparently rewrites bash commands. This is aligned with the compression feature, but it is persistent and globally scoped rather than limited to a single session or task.

Skill content

# This installs the PreToolUse hook that transparently rewrites bash commands
rtk init -g --auto-patch

Recommendation

Clearly show the exact global changes before applying them, provide a verified uninstall/rollback path, and offer a session- or project-scoped installation mode.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The license key is transmitted to the vendor and stored locally where other local processes or users with file access may read it.

Why it was flagged

Pro activation sends the license key to api.clawtk.co and stores it in ~/.openclaw/clawtk-state.json. This is expected for a paid integration, but it is credential-like data.

Skill content

response=$(curl ... -d "{\"key\": \"$key\"}" "$API_BASE/validate" ... ) ... '.tier = $tier | .licenseKey = $key | .activatedAt = $date'

Recommendation

Users should only activate with a key they are comfortable sending to ClawTK; the skill should store only a scoped token or protect the state file permissions.

Findings (1)

critical

suspicious.dangerous_exec

Location: hooks/clawtk-cache/handler.ts:114
Finding: Shell command execution detected (child_process).