ClawHub
Back to skill

Security audit

AIMA Doctor

Security checks for vulnerabilities and agentic risk

Overview

The skill is meant to repair OpenClaw, but it automatically installs and runs a separate downloaded repair tool that is not included for review.

Review or trust the separate AIMA Doctor runtime before using this skill. It should only be installed if you are comfortable with a downloaded helper running with your user account's access to OpenClaw files, processes, and possible recovery material; verify the checksum, prefer a restricted environment, and avoid providing sensitive tokens unless the repair specifically requires them.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:20
Finding

Automatic Retrieval and Execution of an Unreviewed Remote Runtime

Content
View full analysis
" ``` 6. On Windows, run: ```powershell & "$env:USERPROFILE\.openclaw\tools\aima-doctor\run.ps1" --run --terminal --symptom "" ``` ``` ### Technical Analysis The skill directs the agent to download an executable archive from an external GitHub release, extract it into the user's OpenClaw tools directory, and execute its shell or PowerShell entrypoint. The downloaded runtime is not included in the audited project, so its behavior cannot be reviewed from the a ...[truncated 2881 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:30
Finding

Potential Shell Command Injection Through Symptom Interpolation

Content
View full analysis
" ``` 6. On Windows, run: ```powershell & "$env:USERPROFILE\.openclaw\tools\aima-doctor\run.ps1" --run --terminal --symptom "" ``` ``` ### Technical Analysis The skill requires the agent to derive a symptom string from user-controlled content and insert it into a command template. It does not define an escaping algorithm, permitted character set, maximum length, or requirement to invoke the process through an argument-array API. Quoting the placeholder is insufficient if the substituted text can contain quote characters or shell-specific expressions. In a shell-string execution context, a crafted symptom containing closing quotes, command separators, command substitution, redirection, or PowerShell expressions could alter the command's syntax. The exact exploit syntax depends on the operating system and on how the OpenClaw execution tool passes commands to Bash or PowerShell. The instruction to summarize the symptom may reduce the likelihood that raw malicious syntax is preserved, but it is not a security boundary. An agent may reproduce code-like content when it appears relevant to the reported problem. ### Attack Path 1. An attacker or untrusted user supplies a diagnostic symptom containing shell or PowerShell metacharacters designed to escape the quoted argument. 2. The agent summarizes the input but preserves the crafted sequence in the symptom value. 3. The agent replaces the `` placeholder in the documented command template. 4. The resulting command is submitted as a shell command string rather than as a saf ...[truncated 927 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
- The helper runtime lives at `~/.openclaw/tools/aima-doctor/`.
- The runtime is the source of truth for diagnosis and repair progress.
- Never ask the user to paste `curl | bash`, `iex (irm ...)`, base64 payloads, or other remote shell one-liners.
- If the runtime is not installed, direct the user to download it from the GitHub release: `https://github.com/Approaching-AI/aima-openclaw/releases` and extract into `~/.openclaw/tools/aima-doctor/`. Verify the archive checksum: `sha256:0f38959c6759e72a25bf089c9ab4aef1cf0022ba3aef1ea6686593896e973d1e`.

## Execution rules

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
- The helper runtime lives at `~/.openclaw/tools/aima-doctor/`.
- The runtime is the source of truth for diagnosis and repair progress.
- Never ask the user to paste `curl | bash`, `iex (irm ...)`, base64 payloads, or other remote shell one-liners.
- If the runtime is not installed, direct the user to download it from the GitHub release: `https://github.com/Approaching-AI/aima-openclaw/releases` and extract into `~/.openclaw/tools/aima-doctor/`. Verify the archive checksum: `sha256:0f38959c6759e72a25bf089c9ab4aef1cf0022ba3aef1ea6686593896e973d1e`.

## Execution rules

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly instructs the agent to automatically download, extract, and install a runtime into the user's home directory, then rely on it for repair. Even with a checksum, this causes persistent filesystem changes and leads to execution of newly fetched code without an explicit user approval step, which is risky for a user-invocable skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

The skill directs the agent to create a persistent directory in the user's home folder and extract a runtime there, establishing session-to-session state and a durable execution surface. Persistent installation increases risk because compromised or outdated helper code can remain on disk and be reused later without renewed scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
2. If the runtime is missing, install it automatically:
   - Download `aima-doctor-runtime.zip` from `https://github.com/Approaching-AI/aima-openclaw/releases/download/v0.2/aima-doctor-runtime.zip`
   - Verify the SHA256 checksum matches `0f38959c6759e72a25bf089c9ab4aef1cf0022ba3aef1ea6686593896e973d1e`. If it does not match, stop and warn the user.
   - Create the target directory `~/.openclaw/tools/aima-doctor/` if it does not exist.
   - Extract the archive into that directory.
   - Confirm the runtime is now present before proceeding.
3. Prefer the packaged helper over ad-hoc shell commands.

Static analysis

No suspicious patterns detected.