Claude-Code引擎赋能OpenClaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:29 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-coherent but asks users to install persistent root-scoped automation and a broad shell-based task executor that can run high-impact commands without tight safeguards.

Install only if you intentionally want privileged, persistent OpenClaw automation. Review and modify the setup first: avoid /root paths, remove or separately opt into cron jobs, pin dependencies, avoid npx @latest, replace shell=True task execution with allowlisted commands, and add clear memory retention and deletion controls.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

• Location: SKILL.md:122

Finding

Persistent Six-Hour Cron Job Executes a Mutable Root-Scoped Script

Content

View full analysis

/dev/null; echo "0 */6 * * * /root/.openclaw/scripts/self-reflection.sh") | crontab - ``` ### Technical Analysis The Skill directs the user to make `/root/.openclaw/scripts/self-reflection.sh` executable and register it as a recurring cron job. The job survives completion of the Skill and executes the referenced script every six hours in the security context of the crontab owner. Although scheduled reflection relates to the declared automation functionality, persistent root-scoped scheduling is not necessary for on-demand reflection. The instructions do not request explicit confirmation before creating persistence, do not validate the script's ownership or integrity, and provide no removal procedure. The referenced script remains mutable. Any process or user that later gains write access to the script or its parent directory can alter the payload and obtain recurring execution. Re-running the installation command also appends duplicate entries because it performs no idempotency check. ### Attack Path 1. A user follows the Skill instructions with sufficient permission to write under `/root` and update the applicable crontab. 2. The Skill creates an executable script under `/root/.openclaw/scripts`. 3. A cron entry is installed and remains active across sessions and reboots where cron is enabled. 4. An attacker or compromised component modifies `self-reflection.sh`. 5. Cron executes the modified script every six hours with the crontab owner's privileges. ### Impact Assessment If installed in root's crontab as implied by the hardcoded paths, compromise of the script permits recurring root-level command execution. This could affect all local files, credentials, services, and users accessible to root. Even wh ...[truncated 244 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: SKILL.md:419

Finding

Persistent Thirty-Minute Health-Check Cron Job Expands the Execution Surface

Content

View full analysis

/dev/null; echo "*/30 * * * * /root/.openclaw/scripts/health_check.sh") | crontab - ``` The scheduled script also invokes other mutable files: ```bash /root/.openclaw/scripts/self-reflection.sh python3 /root/.openclaw/scripts/context_compressor.py --compress ``` ### Technical Analysis The Skill installs a second persistent job that executes every 30 minutes. This health-check script can transitively execute both a shell script and a Python script. Consequently, compromise of any of three mutable files can become a scheduled execution path. The job is installed without user confirmation, integrity validation, locking, duplicate detection, resource limits, or an uninstall process. The hardcoded `/root` paths imply privileged operation even though checking idle state and memory utilization does not inherently require root access. ### Attack Path 1. The user creates `health_check.sh` under the root-scoped OpenClaw directory. 2. The provided command registers the script in a persistent crontab. 3. An attacker modifies `health_check.sh`, `self-reflection.sh`, or `context_compressor.py` through another vulnerability or compromised dependency. 4. Within 30 minutes, cron starts the health-check script. 5. The modified direct or transitive payload runs with the crontab owner's privileges. ### Impact Assessment When configured for root, this provides a recurring root-level execution mechanism that can be used to alter system configuration, access protected data, establish further persistence, or execute arbitrary programs. It also increases availability risk because duplicate entries or expensive compression tasks may repeatedly consume system resources. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:218

Finding

Task-Controlled Input Is Executed Through a Shell

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:134

Finding

Unpinned Python Dependencies Permit Non-Reproducible Supply-Chain Code

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:234

Finding

Runtime Use of an Unpinned Latest Package Retrieves and Executes Changing Code

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

The YARA hit is driven by cron-based persistence patterns rather than an explicitly malicious payload, so this is not strong evidence of malware by itself. However, persistent scheduled execution under /root is still dangerous because it creates a durable mechanism for unattended code execution.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

$(date +%Y%m%d_%H%M%S) log_file="$REFLECTION_DIR/${timestamp}.md"

cat > "$log_file" << 'LOG'

自我反思日志

时间

{TIMESTAMP}

教训 (Lessons)

经验 (Experiences)

错误 (Errors)

成功 (Successes)

待优化 (Improvements)

LOG

echo "反思已记录: $log_file" EOF chmod +x /root/.openclaw/scripts/self-reflection.sh

添加到 crontab（每6小时）

(crontab -l 2>/dev/null; echo "0 */6 * * * /root/.openclaw/scripts/self-reflection.sh") | crontab -

text

### 3.2 向量检索配置

**目标**：从记忆文件中精准检索

```bash
# 安装向量检索依赖
pip install chromadb sentence-transformers

# 创建向量检索脚本
cat > /root/.openclaw/scripts/vector-search.py << 'EOF'
#!/usr/bin/env python3
"""
OpenClaw 向量检索系统
基于 ChromaDB + Sentence-Transformers
"""

import chromadb
from sentence_transformers import SentenceTransformer
from pathlib import Path
import os

class VectorMemory:
    def __init__(self, persist_dir=

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The subagent executor accepts task-controlled commands and executes them through subprocess.run(..., shell=True), enabling arbitrary shell command execution. In a concurrent executor this is especially dangerous because multiple untrusted or mistaken tasks can run in parallel, amplifying destructive impact.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

subprocess.run(command, shell=True, ...) executes task-supplied strings through a shell, which is a classic command injection sink. Any untrusted or malformed input can execute arbitrary commands, access files, install persistence, or destroy data with the privileges of the running process.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

md

command = task.get("command")
        
        if task_type == "bash":
            result = subprocess.run(
                command, shell=True, 
                capture_output=True, text=True, timeout=task.get("timeout", 300)
            )

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The skill task path builds f"npx clawhub@latest run {command}" and executes it with shell=True, allowing shell metacharacter injection through the command field. This combines command injection with unpinned remote package execution, significantly widening the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

md

}
        elif task_type == "skill":
            # 调用 OpenClaw skill
            result = subprocess.run(
                f"npx clawhub@latest run {command}",
                shell=True, capture_output=True, text=True
            )

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill explicitly promotes long-term collection, storage, and retrieval of user/project memory in plain language. Without data minimization, access controls, or sensitivity filtering, this increases the chance that prior secrets, proprietary information, or personal data are resurfaced to later prompts or users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The documentation normalizes network-capable tools and package installation without clearly warning that external connectivity can expose metadata, prompts, or retrieved content. In combination with memory features and browsing, this can lead to unintended data disclosure or dependency risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

These instructions create files under /root, mark them executable, and install scheduled tasks without a clear warning that they make persistent system changes. Users may unknowingly authorize host modifications that survive beyond the current session and are harder to audit or remove.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation installs a recurring cron job for self-reflection, creating persistent autonomous execution on the host. That persistence is broader than a one-time engine-architecture upgrade and can continue running without fresh user approval, increasing the blast radius of future changes or misuse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

Installing a cron entry establishes session persistence that survives the current interaction and continues executing code automatically. Persistence is risky because it creates a durable foothold for any future script modification or misbehavior, especially under /root.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

chmod +x /root/.openclaw/scripts/self-reflection.sh

添加到 crontab（每6小时）

(crontab -l 2>/dev/null; echo "0 */6 * * * /root/.openclaw/scripts/self-reflection.sh") | crontab -

text

### 3.2 向量检索配置

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The vector memory system ingests entire .md memory files and returns semantically matched content directly, which can surface sensitive historical data far outside the immediate task context. Because retrieval is based on similarity rather than strict access boundaries, users may unintentionally expose confidential text through broad queries.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The skill invokes npx clawhub@latest, which fetches and executes the latest remote package version at runtime instead of a pinned, reviewed release. This creates supply-chain risk because a compromised or breaking upstream release could execute unexpected code on the host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The health-check section adds recurring host monitoring and automatic execution every 30 minutes via cron. This introduces ongoing system-level behavior outside the narrow stated purpose and can repeatedly trigger scripts that modify files or consume resources.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

This cron installation creates ongoing health-check execution every 30 minutes, establishing another persistent autonomous task on the host. Combined with scripts that can trigger compression or reflection actions, it increases operational and security risk beyond the declared scope.

Content

Scanner excerpt · SKILL.md (reported line 422)May include surrounding context.

chmod +x /root/.openclaw/scripts/health_check.sh

添加到 crontab（每30分钟检查）

(crontab -l 2>/dev/null; echo "*/30 * * * * /root/.openclaw/scripts/health_check.sh") | crontab -

text

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The generic memory-search trigger is ambiguous and may cause retrieval of stored content without sufficient user intent verification. In a system that stores broad historical memory, accidental activation can expose prior sensitive project or user data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The generic memory-search trigger is ambiguous and may cause retrieval of stored content without sufficient user intent verification. In a system that stores broad historical memory, accidental activation can expose prior sensitive project or user data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 534)May include surrounding context.

bash

# 1. 确认 crontab 已配置
crontab -l | grep self-reflection

# 2. 确认向量数据库已初始化
ls /root/.openclaw/workspace/memory/vector_db/

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The entire skill documentation, including trigger phrases and operational guidance, is presented only in Chinese, and the example invocations assume Chinese-language interaction. For an all-file-types policy check, this can constitute a language/locale constraint when no user opt-in, alternative language option, or documented region-specific justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.