Openclaw Config Guard

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 10:24 PM UTC
• Version: 1.0.0

Overview

This skill is a focused OpenClaw configuration audit and repair helper, with some implementation cautions but no artifact-backed malicious behavior.

Install only if you want an agent to inspect and potentially modify your OpenClaw configuration. Review proposed config changes before allowing writes, keep your config directory private, and be aware that the helper's backup naming should be hardened before relying on it in a shared or adversarial local environment.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/config_guard.py:88

Finding

Predictable Backup Path Permits Symlink-Based File Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/config_guard.py, lines 88–89
Vulnerability Type: Predictable and non-exclusive backup-file creation
Risk Level: Medium

python

timestamp = datetime.now(timezone.utc).strftime("%Y%m%d-%H%M%SZ")
backup_path = path.with_name(f"{path.name}.bak.{timestamp}")
shutil.copy2(path, backup_path)

Technical Analysis

The backup filename is based on a UTC timestamp with one-second precision, making its value predictable. The destination is not reserved atomically using exclusive-creation semantics before shutil.copy2() writes to it.

If a destination path already exists as a symbolic link, shutil.copy2() follows that link and writes to its target. Consequently, an attacker with write access to the configuration directory can pre-create a symlink at the predicted backup path and redirect the backup write to another file.

This is a time-of-check/time-of-use and unsafe-file-creation weakness. It undermines the script’s stated backup and rollback guarantees.

Attack Path

1. The attacker has write access to the directory containing the OpenClaw configuration file.
2. The attacker predicts the backup filename from the configuration filename and current UTC timestamp, for example, openclaw.json.bak.20260911-120000Z.
3. Before the backup command reaches shutil.copy2(), the attacker creates that path as a symbolic link to a target file.
4. The user invokes the script’s backup command during the predicted second.
5. shutil.copy2() follows the attacker-controlled symbolic link and overwrites the linked target with the configuration contents.

Impact Assessment

The attacker can overwrite or corrupt files that are writable by the account running the Skill. The operation does not independently grant additional operating-system privileges, so its scope is limited to the invoking user’s existing write permissions.

Potential effects include denial of service, corruption of user-owned application ...[truncated 206 chars]

Remediation

View remediation

Remediation Suggestions

Create and reserve the backup destination atomically rather than constructing a predictable pathname and passing it directly to shutil.copy2().

• Use tempfile.mkstemp() in the configuration directory, or use os.open() with O_CREAT | O_EXCL and, where supported, O_NOFOLLOW.
• Copy the configuration through the securely opened file descriptor so the destination cannot be replaced between creation and writing.
• Generate a cryptographically unpredictable suffix instead of relying only on a second-resolution timestamp.
• Explicitly reject symbolic-link destinations.
• Apply restrictive permissions to the backup, such as matching the source file’s intended private access without briefly exposing broader permissions.
• Flush and close the backup before reporting success.
• If a human-readable timestamp is required, include it as part of the name while retaining a random suffix and exclusive creation.
• Add tests that pre-create a destination symlink and verify that the backup operation fails safely without modifying the symlink target.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill promises deterministic repair, rollback, and safe startup validation, but the described behavior appears to rely mainly on validation wrappers and indirect checks rather than implementing the claimed repair and rollback guarantees. In a configuration-repair context, this mismatch is dangerous because users may trust the skill to make safe reversible changes, yet failed edits or incomplete recovery logic could leave the application misconfigured or unavailable.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

`<skill-dir>` means the directory that contains this `SKILL.md`. Resolve relative paths against this skill directory instead of assuming any environment variabl

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/config_guard.py (reported line 62)May include surrounding context.

python

def _env_for_path(path: Path) -> dict[str, str]:
    env = os.environ.copy()
    env["OPENCLAW_CONFIG_PATH"] = str(path)
    return env

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes shell commands and performs file reads/writes, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an overbroad execution surface where a host agent may grant more capabilities than users expect, increasing the chance of unintended command execution or filesystem modification when the skill is used.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/config_guard.py (reported line 25)May include surrounding context.

python

env: dict[str, str] | None = None,
    check: bool = False,
) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        command,
        text=True,
        capture_output=True,