self-check

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:53 AM UTC
• Version: 1.0.0

Overview

This is a disclosed OpenClaw diagnostic skill that checks local environment health and reports fixes without automatically changing the system.

Install only if you are comfortable with a local diagnostic script reading OpenClaw-related config, skill metadata, logs, permissions, and API-key presence. Treat its suggested fix commands as advice: review them first, avoid curl|bash installer patterns, and run sudo commands only when you intentionally want to change ownership.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/self_check.py:126

Finding

Unverified Remote Installer Recommended for Direct Shell Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/self_check.py:126
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Medium

python

result.add_issue("nvm 不可用", "安装 nvm: curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash", "warning")

Technical Analysis

The self-check report recommends downloading an installation script from an external URL and piping it directly into bash. This pattern executes the response before the user can inspect it and provides no checksum, cryptographic-signature, or content verification.

The referenced URL belongs to the expected nvm-sh/nvm GitHub repository and is pinned to version v0.39.0, rather than an apparent personal paste site. Nevertheless, direct remote-to-shell execution remains unsafe: compromise of the upstream repository, hosting account, release reference, delivery infrastructure, or local trust chain could cause arbitrary shell commands to run.

The Python script only prints this command as remediation advice; it does not download or execute the installer automatically. Exploitation therefore requires a user to follow the generated recommendation manually. Even with this limitation, presenting the command as the standard fix creates a credible social execution path and is unnecessary for the Skill's declared read-only diagnostic function.

Attack Path

1. The self-check determines that nvm is unavailable.
2. It displays the curl ... | bash command as a recommended repair.
3. The user trusts the diagnostic report and manually executes the command.
4. curl retrieves the current response from the external hosting service.
5. bash immediately executes that response without integrity verification or prior review.
6. If the retrieved content has been maliciously modified, it runs arbitrary commands with the invoking user's privileges.

Impact Assessment

A compromised payload would obtain the p ...[truncated 553 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | bash recommendation.
2. Prefer installation through a trusted operating-system package manager where a maintained package is available.
3. If upstream installation is required, instruct the user to download a version-pinned installer to a local file without executing it:

   bash

   curl --fail --proto '=https' --tlsv1.2 \
     --output install-nvm.sh \
     https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh
   

4. Verify the downloaded file against an independently published cryptographic checksum or signature. Do not obtain both the artifact and its integrity value solely through the same untrusted delivery path.
5. Require the user to inspect the local script before execution.
6. Execute it only after explicit confirmation and with an unprivileged account:

   bash

   bash install-nvm.sh
   

7. Consider recommending the latest supported, security-reviewed nvm release rather than the old v0.39.0 installer, while retaining an immutable version pin and documented integrity value.
8. Keep the Skill read-only: it should continue reporting missing dependencies without automatically downloading, installing, or modifying anything.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs running a local Python script that performs broad system inspection, including environment variables, configuration files, permissions, dependencies, and API token presence, yet it declares no explicit tool scope or permission boundaries. This creates an overprivileged skill pattern where file, shell, environment, and potentially network access are implied but not constrained, increasing the chance of unintended sensitive-data access or unsafe execution in an agent framework.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and all user-facing instructions are written in Chinese, and the skill does not indicate that other languages are supported or that Chinese is required for a region-specific reason. This creates a natural-language policy issue because it effectively imposes a specific language on users without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and later report/output strings are written exclusively in Chinese, indicating the skill communicates in a fixed language. For a general self-check utility, this imposes a locale/language choice without any opt-in or documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generated report headings and warnings are hardcoded in Chinese, and the main execution flow also prints Chinese-only status messages. This is a natural-language policy concern because the skill enforces a specific language during operation without offering the user a choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/self_check.py (reported line 80)May include surrounding context.

python

def run_cmd(cmd: str, shell: bool = True, timeout: int = 30) -> Tuple[int, str, str]:
    """运行命令并返回 (returncode, stdout, stderr)"""
    try:
        result = subprocess.run(
            cmd, shell=shell, capture_output=True, text=True, timeout=timeout
        )
        return result.returncode, result.stdout.strip(), result.stderr.strip()

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/self_check.py (reported line 440)May include surrounding context.

python

else:
                result.add_issue(
                    f"权限 {d.name}: 所有者不正确 (uid={owner})",
                    f"sudo chown -R $(whoami):$(whoami) {d}",
                    "warning"
                )

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 81% confidence

Finding

The script recommends piping a remotely fetched script directly into bash. Even though it does not execute the command automatically, presenting this as the remediation path encourages an unsafe supply-chain practice that could lead to arbitrary code execution if the upstream source is compromised, intercepted, or replaced.

Content

Scanner excerpt · scripts/self_check.py (reported line 126)May include surrounding context.

python

if code == 0:
        result.add_pass(f"nvm: {stdout}")
    else:
        result.add_issue("nvm 不可用", "安装 nvm: curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash", "warning")
    
    # npm
    code, stdout, _ = run_cmd("npm --version")