T09 · Insecure Skill Coding Practices
Error
- Location
cli.js:75- Finding
Sensitive credentials are copied into output files without restrictive permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
ClawGuard-Checker
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a legitimate OpenClaw security checker, but it asks for overly broad sensitive-data inspection and can write credential-bearing reports or configs without safe file handling.
Review this skill before installing. Use it only with explicitly scoped OpenClaw configuration paths, avoid broad .env/log/memory scans unless you intentionally opt in, and treat generated reports or hardened configs as sensitive because they may contain live tokens or passwords. Review any hardened config before applying it manually.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:33- Finding
Skill instructions authorize overly broad searches of sensitive local resources
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The second description/behavior mismatch reinforces that the skill claims stronger capabilities than are actually demonstrated, especially around automated hardening and permission analysis. In a security tool, overstated capability is itself risky because users may skip independent verification or assume unsafe states have been remediated when they have not.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The second description/behavior mismatch reinforces that the skill claims stronger capabilities than are actually demonstrated, especially around automated hardening and permission analysis. In a security tool, overstated capability is itself risky because users may skip independent verification or assume unsafe states have been remediated when they have not.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs scanning for credentials in config files, .env files, logs, and optionally process memory, but it provides no user-facing warning or consent boundary for highly sensitive data access. This is dangerous because those sources routinely contain secrets unrelated to the immediate task, creating unnecessary exposure, retention, or disclosure risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill presents one-click hardening and automated fix generation without prominently warning that generated changes may alter authentication, network binding, sandboxing, or command execution behavior. In a security tool, silent or poorly explained remediation can cause outages, lockouts, or unsafe misconfiguration if applied without review.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README defines several natural-language trigger phrases that are generic enough to match ordinary security-help requests, but it does not clearly bound when the skill should auto-activate or what permissions/inputs it may use once triggered. In an agent ecosystem, broad activation criteria can cause the skill to run unexpectedly on unrelated user intent, increasing the chance of unintended file access, confusing tool execution, or exposure to prompt-injection chains via automatic reading of SKILL.md and local config files.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill describes behavior that requires sensitive capabilities such as reading environment/configuration data and invoking shell-like checks, but it declares no tool scope or permissions boundaries. This creates an authorization transparency gap: operators and users cannot easily see what data and actions the skill expects, increasing the chance of over-privileged execution or unsafe deployment assumptions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger phrases are broad enough that the skill could activate on generic requests about security or hardening without clear user intent for deep host inspection. In this skill's context, accidental invocation matters because the workflow includes scanning configs, logs, environment files, and possibly other sensitive locations.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### Step 3: Check File Permissions Verify these permissions: - `~/.openclaw/openclaw.json` should be 600 (owner read/write only) - `~/.openclaw/` directory should be 700 - SSH keys should be 600 - Not running as root user
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
md | Check | Severity | Points | Rule | |-------|----------|--------|------| | Config file world-readable | CRITICAL | -20 | Mode & 007 !== 0 | | Config file group-readable | HIGH | -10 | Mode & 070 !== 0 | | SSH keys world-readable | CRITICAL | -20 | Mode & 004 !== 0 | | Running as root | CRITICAL | -25 | UID === 0 |
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
md | Check | Severity | Points | Rule | |-------|----------|--------|------| | Config file world-readable | CRITICAL | -20 | Mode & 007 !== 0 | | Config file group-readable | HIGH | -10 | Mode & 070 !== 0 | | SSH keys world-readable | CRITICAL | -20 | Mode & 004 !== 0 | | Running as root | CRITICAL | -25 | UID === 0 |
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
md | Config file group-readable | HIGH | -10 | Mode & 070 !== 0 | | SSH keys world-readable | CRITICAL | -20 | Mode & 004 !== 0 | | Running as root | CRITICAL | -25 | UID === 0 | | Workspace world-writable | HIGH | -15 | Mode & 002 !== 0 | ## Phase 4: Network Security Analysis
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file's user-facing strings, including the header, usage instructions, option descriptions, status messages, and error text, are presented in Chinese only. This imposes a specific language on users without opt-in or any indication that the tool is intentionally region-specific, which matches the language/locale policy violation criteria.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a broader security capability set including runtime integrity verification and permission modeling. In this file, the implemented behavior is limited to parsing CLI flags, locating a config file, invoking a checker on that file, and optionally writing a report or hardened configuration; there is no visible runtime integrity verification or permission-modeling logic exposed here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JavaScript file contains natural-language strings in Chinese in the header comments and throughout the user-facing console output, indicating the skill is designed to communicate in a single language by default. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest advertises "runtime integrity verification," which suggests checking a live process, runtime state, binaries, or environment integrity. The code only loads a JSON config, evaluates rule predicates, and in deep mode checks config file permissions and token entropy; there is no runtime attestation or integrity verification logic.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
js description: `配置文件可被其他用户读取 (权限: ${mode.toString(8)})`, impact: '其他用户可能读取敏感配置', risk: 'WARNING', recommendation: '执行: chmod 600 ' + this.options.configPath }); } } catch (e) {
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes "one-click hardening recommendations," which implies an operational hardening action or at least code that applies changes. In this file, generateHardenedConfig only clones the report config and returns a modified object; no file write, runtime reconfiguration, or enforcement occurs anywhere in the implementation shown.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The heading "Hardening Recommendations (v3 核心功能)" introduces Chinese text into an otherwise English document without offering the user a language preference or explaining a locale-specific requirement. This can violate language/locale policy expectations when a skill implicitly forces mixed-language output or documentation.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
A security checker naturally reads configuration and reports findings, but this CLI also writes a report to any requested path and generates a hardened configuration file intended for later replacement of the original config. Because the manifest emphasizes analysis and verification, the write/remediation capability is only justified if 'one-click hardening recommendations' is intended to include local artifact generation rather than just advice.
- Content
Static analysis
No suspicious patterns detected.