Clawd Zero Trust

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:24 PM UTC
• Version: 1.3.2

Overview

This appears to be a real security-hardening skill, but it includes high-impact firewall and OpenClaw execution settings that can weaken the protections it advertises.

Review this skill carefully before installing. Do not run harden.sh --apply or egress-filter.sh --apply as shipped in a sensitive environment until you remove or constrain full non-interactive gateway exec, remove the unrestricted outbound 443 rule, add validation and approval to whitelist.sh, and verify any post-update repair script independently. Treat it as a high-impact administrative tool, not a low-risk advisory skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (8)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:169

Finding

Mandatory instructions hijack Agent behavior and promote an unaudited script

Content

View full analysis

latest version. Always: 1. Present update details + changelog to Founder first 2. Backup config: `cp openclaw.json openclaw.json.pre-update` 3. Only update after explicit approval 4. Run `openclaw doctor --fix` + `openclaw status` after ## MANDATORY: Update Proposal Format When you detect that an OpenClaw update is available (via update-scout-daily or any other means), you MUST ALWAYS propose it in exactly this format — no exceptions: 📦 **OpenClaw update available: vOLD → vNEW** To apply safely, SSH in and run: ```bash openclaw update /home/claw/.openclaw/workspace/scripts/post-update-repair.sh ``` The repair script restores all symlinks, cleans config, restarts the gateway, and runs a 6-point smoke test automatically. No other steps needed. NEVER say "I will run the update for you" or attempt to run it yourself. The update MUST be executed by the Founder via SSH. ``` ### Technical Analysis The Skill text contains imperative instructions that alter the Agent's future behavior whenever update-related subjects arise. It mandates an exact response format rather than presenting optional operational guidance. The mandated response promotes `/home/claw/.openclaw/workspace/scripts/post-update-repair.sh`, but that script is not included in the audited project. Its implementation, ownership, permissions, and integrity therefore cannot be verified. A local attacker able to place or replace a script at that path could expl ...[truncated 963 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: hardening.json:13

Finding

Hardening configuration grants unrestricted non-interactive gateway command execution

Content

View full analysis

/dev/null) || { fail "Failed to merge openclaw.json with hardening.json" return 1 } backup="$CONFIG.bak.hardening.$(date -u +%Y%m%d%H%M%S)" cp "$CONFIG" "$backup" || { fail "Failed to create backup: $backup" return 1 } tmp=$(mktemp) echo "$merged" > "$tmp" mv "$tmp" "$CONFIG" ``` ### Technical Analysis The policy sets command execution to `security: "full"` on the gateway and disables confirmation with `ask: "off"`. The Telegram `allowFrom` restriction is nested under `tools.elevated`; it does not scope the separate `tools.exec` policy. The hardening script merges this configuration into the live OpenClaw configuration without validating that execution is identity-scoped, sandboxed, or restricted to an approved command set. The accompanying PLP implementation does not compensate for this exposure: it defaults to an overrideable `graceful` mode and synchronizes restrictions only for one specified model provider. This configuration is contrary to the declared principle of least privilege. ### Attack Path 1. An untrusted prompt, external message, model response, or compromised plugin reaches an Agent with access to `exec`. 2. The Agent or plugin requests an arbitrary command. 3. OpenClaw routes execution to the gateway host. 4. `security: "full"` permits unrestricted command behavior. 5. `ask: "off"` prevents an operator confirmation prompt. 6. The command executes with the privileges of the Op ...[truncated 389 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/egress-filter.sh:1286

Finding

Destination-independent HTTPS rule bypasses the provider egress allowlist

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/whitelist.sh:5

Finding

Whitelist helper creates arbitrary persistent egress exceptions and bypasses the integrity gate

Content

View full analysis

" echo "Example: ./whitelist.sh customemail.com 587" exit 1 fi DOMAIN=$1 PORT=$2 CONFIG_DIR="$(dirname "$0")/../config" PROVIDERS_FILE="$CONFIG_DIR/providers.txt" FILTER_SCRIPT="$(dirname "$0")/egress-filter.sh" if [ ! -f "$PROVIDERS_FILE" ]; then echo "❌ Error: $PROVIDERS_FILE not found." exit 1 fi # Append seamlessly to the text database echo "$DOMAIN $PORT" >> "$PROVIDERS_FILE" echo "✅ Added $DOMAIN mapping to port $PORT in $PROVIDERS_FILE" # Trigger a transactional UFW deployment echo "🔄 Executing Zero Trust application..." sudo bash "$FILTER_SCRIPT" --apply --force ``` ### Technical Analysis The helper accepts arbitrary domain and port strings, persists them before validation, and invokes the firewall script with `--force`. The force flag bypasses the egress profile's script-hash mismatch protection. Downstream processing confirms only that some providers resolve and that returned addresses resemble IP addresses. It does not enforce: - Valid fully qualified hostname syntax. - A port range of 1–65535. - An approved service or provider registry. - Ownership of the target destination. - Explicit authorization for sensitive protocols. - Rollback of the appended configuration line if application fails. This is not a shell-command injection because arguments remain quoted in downstream UFW invocations. The confirmed issue is unauthorized policy expansion and integrity-gate bypass. ### Attack Path 1. An attacker gains the ability to invoke the helper through unrestricted Agent execution or local account access. 2. The attacker runs `whitelist.sh attacker.example 443`. 3. The destination is appended permanently to `config/providers.txt`. 4. The script invokes the ...[truncated 567 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/egress-filter.sh:608

Finding

Top-priority deny rule can cause lockout followed by permissive fail-open rollback

Content

View full analysis

&1 || true)" local existing_nums existing_nums="$(echo "$ufw_status" \ | grep 'ZT:egress-violation' \ | awk -F'[][]' '{print $2}' \ | tr -d ' ' \ | grep -E '^[0-9]+$' \ | sort -rn || true)" if [ -n "$existing_nums" ]; then log " Removing existing ZT:egress-violation rules for clean re-insert..." while IFS= read -r num; do [ -z "$num" ] && continue sudo ufw --force delete "$num" >/dev/null 2>&1 || \ log " WARN: Failed to delete ZT:egress-violation rule #${num}" done <<< "$existing_nums" fi log " Inserting fresh egress violation LOG rule (deny log out to any)" sudo ufw insert 1 deny log out to any comment "ZT:egress-violation" 2>/dev/null || { log " WARN: insert with comment failed, trying alternative..." sudo ufw deny out log to any comment "ZT:egress-violation" 2>/dev/null || { log " WARN: Could not add egress violation LOG rule (non-fatal)" return 0 } } } ``` Rollback uses a permissive default rather than restoring the prior policy: ```bash perform_reset() { require_root log "RESET: Restoring permissive defaults" cmd sudo ufw default allow outgoing || return 1 cmd sudo ufw reload || return 1 log "Reset complete. Outgoing traffic: allow." return 0 } ``` ### Technical Analysis The explicit `deny log out to any` rule is inserted at rule position 1. Under ordered firewall evaluation, it can match outbound traffic before provider-specific allow rules, resulting in broad ...[truncated 1218 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/package_skill.py:8

Finding

Release packaging can disclose runtime state and symlink-referenced files

Content

View full analysis

None: skill_dir = os.path.abspath(skill_dir) out_file = os.path.abspath(out_file) os.makedirs(os.path.dirname(out_file), exist_ok=True) root_name = os.path.basename(skill_dir) with zipfile.ZipFile(out_file, 'w', compression=zipfile.ZIP_DEFLATED) as zf: for base, _, files in os.walk(skill_dir): for name in files: if name.endswith('.pyc'): continue full = os.path.join(base, name) rel = os.path.relpath(full, skill_dir) arc = os.path.join(root_name, rel) zf.write(full, arc) sha256_hash = hashlib.sha256() with open(out_file, 'rb') as f: for chunk in iter(lambda: f.read(4096), b''): sha256_hash.update(chunk) ``` The release gate packages the live Skill directory directly: ```bash mkdir -p "$DIST_DIR" info "Packaging skill" python3 "$SCRIPT_DIR/package_skill.py" "$SKILL_DIR" "$OUT_FILE" || fail "package_skill.py failed" ``` ### Technical Analysis The packager includes every discovered file except `.pyc` files. It has no explicit release manifest and does not exclude `.state`, backup files, temporary files, logs, local configuration, or secrets accidentally written beneath the Skill directory. Regular file symlinks are not rejected. `zipfile.write()` opens the supplied path and can archive the referenced content under the symlink's relative name. Consequently, a symlink placed inside the source directory may cause content outside the intended package tree to enter the release artifact. The project explicitly documents `.state` as a runtime directory, making its omission from packaging exclusions partic ...[truncated 689 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/plugin-integrity.sh:66

Finding

Plugin integrity verification hashes only one entry-point file per plugin

Content

View full analysis

/dev/null | head -1)" if [ -n "$first_js" ]; then echo "$first_js" fi fi } ``` The snapshot implementation follows the same single-file selection: ```python js_path = None candidate = os.path.join(pdir, 'dist', 'index.js') if os.path.isfile(candidate): js_path = candidate else: candidate = os.path.join(pdir, 'index.js') if os.path.isfile(candidate): js_path = candidate else: try: for f in sorted(os.listdir(pdir)): if f.endswith('.js') and os.path.isfile(os.path.join(pdir, f)): js_path = os.path.join(pdir, f) break except OSError: pass sha = hashlib.sha256() try: with open(js_path, 'rb') as f: for chunk in iter(lambda: f.read(65536), b''): sha.update(chunk) ``` ### Technical Analysis The integrity baseline covers only one selected JavaScript entry point. It does not hash secondary imported modules, manifests, configuration, native extensions, bundled assets containing code, dependencies, or newly added files. JavaScript entry points commonly import code from other files. An attacker can modify one of those secondary modules while preserving the expected hash of `dist/index.js` or `index.js`. Verification will then report a match even though executable plugin behavior changed. The snapshot is also stored in the same writable Skill tree, so an attacker with access to both the plugin and baseline can replace bot ...[truncated 776 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audit.sh:47

Finding

Name-based false-positive filtering can suppress genuine security findings

Content

View full analysis

/dev/null || true) ``` ### Technical Analysis The filter removes every line containing either plugin name from the actionable findings section. It does not bind suppression to a specific rule ID, file path, line number, plugin version, or verified source hash. A previously reviewed plugin can later be upgraded or compromised. A new critical finding mentioning the same plugin name will still be classified as a verified false positive. Writing the line to a secondary log does not eliminate the risk because the primary operator-facing summary no longer treats it as actionable. An attacker may also cause a finding line to contain one of the excluded strings, leading the broad regular expression to suppress it. ### Attack Path 1. An allowlisted plugin is modified, upgraded, or compromised. 2. The deep OpenClaw audit reports a genuine critical or warning-level issue containing the plugin name. 3. `grep -vE` removes the entire line from `CLEAN_FINDINGS`. 4. The issue appears only in the false-positive section or secondary log. 5. The operator relies on the actionable summary and does not investigate. 6. The malicious behavior remains active. ### Impact Assessment The issue can conceal credential access, dynamic code execution, dangerous command execution, or other malicious behavior in named plugins. The resulting compromise scope depends on the plugin's Ope ...[truncated 22 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (85)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The inclusion of release validation, shell linting, packaging, and artifact creation under a security hardening skill introduces scope creep and weakens operator understanding of what the skill is trusted to do. This can blur security review boundaries and increase the chance that users approve broader execution than necessary.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The inclusion of release validation, shell linting, packaging, and artifact creation under a security hardening skill introduces scope creep and weakens operator understanding of what the skill is trusted to do. This can blur security review boundaries and increase the chance that users approve broader execution than necessary.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The inclusion of release validation, shell linting, packaging, and artifact creation under a security hardening skill introduces scope creep and weakens operator understanding of what the skill is trusted to do. This can blur security review boundaries and increase the chance that users approve broader execution than necessary.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The inclusion of release validation, shell linting, packaging, and artifact creation under a security hardening skill introduces scope creep and weakens operator understanding of what the skill is trusted to do. This can blur security review boundaries and increase the chance that users approve broader execution than necessary.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

bash scripts/egress-filter.sh --dry-run

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

bash scripts/egress-filter.sh --dry-run

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

bash scripts/egress-filter.sh --dry-run

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

bash scripts/egress-filter.sh --dry-run

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

bash scripts/egress-filter.sh --dry-run

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

bash scripts/egress-filter.sh --dry-run

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

bash scripts/egress-filter.sh --dry-run

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

bash scripts/egress-filter.sh --dry-run

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

bash scripts/egress-filter.sh --dry-run

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

- `references/zero-trust-principles.md` — Detailed ZT framework for AI agents
- `references/false-positives.md` — Verified safe patterns that trigger audit warnings

## HARD REQUIREMENT: Self-Update Prevention

**NEVER run `openclaw update`, `openclaw upgrade`, `npm install -g openclaw`, or `npm update -g openclaw` without explicit Founder approval.**

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file first forbids self-updates without explicit approval, then later mandates a prescriptive update proposal that includes exact commands to run, including openclaw update and a repair script with 'No other steps needed.' This contradiction is dangerous because it normalizes a self-modification path despite earlier safety restrictions, making social-engineering or unsafe update execution more likely.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md

**NEVER run `openclaw update`, `openclaw upgrade`, `npm install -g openclaw`, or `npm update -g openclaw` without explicit Founder approval.**

These commands are blocked in `denyCommands`. On 2026-02-24, a self-update during an audit caused a 10,450+ crash-loop by deprecating a plugin. System stability > latest version. Always:
1. Present update details + changelog to Founder first
2. Backup config: `cp openclaw.json openclaw.json.pre-update`
3. Only update after explicit approval

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This hardening configuration enables elevated tooling and disables interactive approval for exec operations, which undermines the stated Zero Trust purpose of the skill. Even though elevated access is nominally restricted to a specific Telegram user ID, the combination of elevated execution, exec security set to full, and ask set to off creates a path for privileged actions without human verification if that identity, integration, or surrounding control plane is abused.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/egress-filter.sh (reported line 63)May include surrounding context.

sh

TEMP_FILES=()
cleanup_all_temps() {
  for tf in "${TEMP_FILES[@]:-}"; do
    [ -n "$tf" ] && rm -f "$tf" 2>/dev/null
  done
}
trap 'cleanup_all_temps' EXIT

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/egress-filter.sh (reported line 188)May include surrounding context.

sh

echo -e "${RED}[FATAL]${NC} Cannot write to state directory: $STATE_DIR (permission denied)" >&2
  exit 1
fi
rm -f "$STATE_DIR/.write-test"

log() { echo -e "[$(date -u '+%Y-%m-%d %H:%M:%S UTC')] $1" | tee -a "$LOG_FILE"; }

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/egress-filter.sh (reported line 636)May include surrounding context.

sh

log "  Removing existing ZT:egress-violation rules for clean re-insert..."
    while IFS= read -r num; do
      [ -z "$num" ] && continue
      sudo ufw --force delete "$num" >/dev/null 2>&1 || \
        log "  WARN: Failed to delete ZT:egress-violation rule #${num}"
    done <<< "$existing_nums"
  fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/egress-filter.sh (reported line 1246)May include surrounding context.

sh

log "  Removing existing ZT:egress-violation rules for clean re-insert..."
    while IFS= read -r num; do
      [ -z "$num" ] && continue
      sudo ufw --force delete "$num" >/dev/null 2>&1 || \
        log "  WARN: Failed to delete ZT:egress-violation rule #${num}"
    done <<< "$existing_nums"
  fi

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/egress-filter.sh (reported line 994)May include surrounding context.

sh

local context="${1:-unknown}"
  if ! perform_reset; then
    log "🚨 CRITICAL [${context}]: Rollback FAILED. System may be locked out."
    log "🚨 Manual recovery: sudo ufw default allow outgoing && sudo ufw reload"
    write_state "LOCKOUT-MANUAL-INTERVENTION-REQUIRED"
    exit 99
  fi

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The header frames the script as 'Zero Trust hardening' while it actually weakens outbound controls by allowing arbitrary new egress destinations and immediately applying firewall changes. In a security-hardening skill, this mismatch is a strong indicator of deceptive functionality because operators may trust and run it under the assumption that it improves security.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims to harden OpenClaw with Zero Trust controls, but this code does the opposite by expanding outbound access on demand. That context makes the behavior more dangerous because defenders are more likely to execute it in privileged environments, assuming it reduces risk rather than creating a policy bypass.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script accepts any domain and port, appends them to the provider database, and forces a firewall apply with no validation, authorization check, or approval workflow. This enables silent expansion of outbound connectivity, which can be used to bypass egress restrictions for command-and-control, data exfiltration, or unauthorized service access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.