self-check

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:53 AM UTC
• Version: 1.0.0

Overview

This is a disclosed OpenClaw diagnostic skill that checks local environment health and reports fixes without automatically changing the system.

Install only if you are comfortable with a local diagnostic script reading OpenClaw-related config, skill metadata, logs, permissions, and API-key presence. Treat its suggested fix commands as advice: review them first, avoid curl|bash installer patterns, and run sudo commands only when you intentionally want to change ownership.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/self_check.py:126
• Finding: Unverified Remote Installer Recommended for Direct Shell Execution## Vulnerability Details **File Location**: `scripts/self_check.py:126` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Medium ```python result.add_issue("nvm 不可用", "安装 nvm: curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash", "warning") ``` ### Technical Analysis The self-check report recommends downloading an installation script from an external URL and piping it directly into `bash`. This pattern executes the response before the user can inspect it and provides no checksum, cryptographic-signature, or content verification. The referenced URL belongs to the expected `nvm-sh/nvm` GitHub repository and is pinned to version `v0.39.0`, rather than an apparent personal paste site. Nevertheless, direct remote-to-shell execution remains unsafe: compromise of the upstream repository, hosting account, release reference, delivery infrastructure, or local trust chain could cause arbitrary shell commands to run. The Python script only prints this command as remediation advice; it does not download or execute the installer automatically. Exploitation therefore requires a user to follow the generated recommendation manually. Even with this limitation, presenting the command as the standard fix creates a credible social execution path and is unnecessary for the Skill's declared read-only diagnostic function. ### Attack Path 1. The self-check determines that `nvm` is unavailable. 2. It displays the `curl ... | bash` command as a recommended repair. 3. The user trusts the diagnostic report and manually executes the command. 4. `curl` retrieves the current response from the external hosting service. 5. `bash` immediately executes that response without integrity verification or prior review. 6. If the retrieved content has been maliciously modified, it runs arbitrary commands with the invoking user's privileges. ### Impact Assessment A compromised payload would obtain the p ...[truncated 553 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `curl | bash` recommendation. 2. Prefer installation through a trusted operating-system package manager where a maintained package is available. 3. If upstream installation is required, instruct the user to download a version-pinned installer to a local file without executing it: ```bash curl --fail --proto '=https' --tlsv1.2 \ --output install-nvm.sh \ https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh ``` 4. Verify the downloaded file against an independently published cryptographic checksum or signature. Do not obtain both the artifact and its integrity value solely through the same untrusted delivery path. 5. Require the user to inspect the local script before execution. 6. Execute it only after explicit confirmation and with an unprivileged account: ```bash bash install-nvm.sh ``` 7. Consider recommending the latest supported, security-reviewed nvm release rather than the old `v0.39.0` installer, while retaining an immutable version pin and documented integrity value. 8. Keep the Skill read-only: it should continue reporting missing dependencies without automatically downloading, installing, or modifying anything.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs running a local Python script that performs broad system inspection, including environment variables, configuration files, permissions, dependencies, and API token presence, yet it declares no explicit tool scope or permission boundaries. This creates an overprivileged skill pattern where file, shell, environment, and potentially network access are implied but not constrained, increasing the chance of unintended sensitive-data access or unsafe execution in an agent framework.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The manifest description and all user-facing instructions are written in Chinese, and the skill does not indicate that other languages are supported or that Chinese is required for a region-specific reason. This creates a natural-language policy issue because it effectively imposes a specific language on users without opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The module docstring and later report/output strings are written exclusively in Chinese, indicating the skill communicates in a fixed language. For a general self-check utility, this imposes a locale/language choice without any opt-in or documented region-specific justification.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The generated report headings and warnings are hardcoded in Chinese, and the main execution flow also prints Chinese-only status messages. This is a natural-language policy concern because the skill enforces a specific language during operation without offering the user a choice.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_cmd(cmd: str, shell: bool = True, timeout: int = 30) -> Tuple[int, str, str]:
    """运行命令并返回 (returncode, stdout, stderr)"""
    try:
        result = subprocess.run(
            cmd, shell=shell, capture_output=True, text=True, timeout=timeout
        )
        return result.returncode, result.stdout.strip(), result.stderr.strip()

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

else:
                result.add_issue(
                    f"权限 {d.name}: 所有者不正确 (uid={owner})",
                    f"sudo chown -R $(whoami):$(whoami) {d}",
                    "warning"
                )

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Script Fetching

Low

• Category: Supply Chain

Content

if code == 0:
        result.add_pass(f"nvm: {stdout}")
    else:
        result.add_issue("nvm 不可用", "安装 nvm: curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash", "warning")
    
    # npm
    code, stdout, _ = run_cmd("npm --version")

• Confidence: 81% confidence
• Finding: The script recommends piping a remotely fetched script directly into bash. Even though it does not execute the command automatically, presenting this as the remediation path encourages an unsafe supply-chain practice that could lead to arbitrary code execution if the upstream source is compromised, intercepted, or replaced.

Static analysis

No suspicious patterns detected.