T09 · Insecure Skill Coding Practices
Error
- Location
scripts/lib/config.sh:6- Finding
Predictable Temporary Configuration Allows Command Resolution Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
SysGuard
Security checks for vulnerabilities and agentic risk
Overview
SysGuard is mostly a coherent system-monitoring skill, but it exposes system cleanup and long-running monitoring through broadly usable chat commands with weak scoping and a risky temporary configuration fallback.
Install only in an admin-controlled OpenClaw environment, preferably under a dedicated unprivileged account. Restrict who can send SysGuard commands, disable or gate sgc and sgm unless needed, use a private 0600 config path instead of any /tmp fallback, and only configure trusted Feishu or WeCom webhooks because alert content leaves the host.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/clean.sh:10- Finding
Destructive System-Wide Cleanup Is Exposed Without Authorization
- Content
View full analysis
/dev/null | awk '{print $1}') find /tmp/openclaw -type f -mtime +1 -delete 2>/dev/null || true local after=$(du -sb /tmp/openclaw 2>/dev/null | awk '{print $1}') freed=$((freed + before - after)) echo "🧹 清理 OpenClaw 临时文件..." fi # Clean npm cache if command -v npm &>/dev/null; then npm cache clean --force 2>/dev/null || true echo "🧹 清理 NPM 缓存..." fi # Clean journal logs (older than 7 days) if command -v journalctl &>/dev/null; then journalctl --vacuum-time=7d 2>/dev/null || true echo "🧹 清理系统日志 (保留7天)..." fi # Clean old history data local history_dir="$(dirname "${BASH_SOURCE[0]}")/../data/history" if [[ -d "$history_dir" ]]; then find "$history_dir" -name "*.json" -mtime +${HISTORY_RETENTION_DAYS} -delete 2>/dev/null || true echo "🧹 清理历史数据 (保留${HISTORY_RETENTION_DAYS}天)..." fi ``` ### Technical Analysis The documented deployment model states that all users can invoke SysGuard through IM conversations. The `sgc` command directly calls `run_clean` without checking the requester's identity, role, or administrative authorization and without requesting confirmation. The operation is broader than Skill-local cache cleanup: - `find /tmp/openclaw ... -delete` removes OpenClaw temporary files ...[truncated 2070 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (29)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The installation note says all users can invoke the skill in any IM conversation by simply saying
sg, which indicates an overly broad trigger surface. This can cause unintended activation in normal chats and may launch system-observing or system-modifying behavior in contexts where the user did not explicitly intend to run an administrative skill.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README advertises 'Safe Cleaning' and the
sgccache cleanup command without warning that it may delete files or alter local state. Framing a destructive or state-changing operation as safe, especially in a chat-invoked skill, can mislead users into triggering cleanup in the wrong environment and causing data loss or operational disruption.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly states that all users can invoke SysGuard 'in any IM conversation' by simply talking to the bot, which encourages overly broad activation semantics for an operational skill that exposes monitoring, diagnostics, and cleanup actions. In an agent environment, ambiguous natural-language triggering increases the chance of accidental execution, social-engineering abuse, or invocation by unauthorized participants in shared chats.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill advertises cache cleaning and persistent background monitoring but provides no visible warnings about side effects, resource usage, permissions, or operational risk. Users may trigger disk-affecting cleanup or long-running monitoring without understanding the impact, increasing the chance of accidental disruption or privacy-sensitive system observation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The phrase
中文优先indicates a language preference policy baked into the skill, but the documentation does not offer the user a choice of language or describe opt-in behavior. This can violate language or locale policy requirements when users have not explicitly selected Chinese output.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill-facing text is written only in Chinese, with no indication that the skill is intended exclusively for a Chinese-speaking audience or that users can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file header states 'Clean Script - Cache & Temp Cleanup', which implies a limited cleanup scope focused on caches and temporary files. However, the implementation also vacuums system journal logs at L33 and deletes JSON history data at L40, which goes beyond cache/temp cleanup and contradicts the documented intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This shell script emits multiple user-facing status messages only in Chinese, such as cleanup progress and completion notices. That creates a language/locale policy issue because the skill forces a specific language without any opt-in or documented regional constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
User-visible strings throughout the diagnostics output are hard-coded in Chinese, including status messages and recommendations, with no indication of user opt-in or locale selection. This is a natural-language policy concern because it constrains the skill to a specific language without offering a choice or documenting a justified region-specific scope.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh fi # --- Event 7: Cron 堆积 --- local cron_count=$(crontab -l 2>/dev/null | grep -v "^#" | grep -v "^$" | wc -l) if [[ $cron_count -gt 20 ]]; then issues[issue_index++]="[7/8] ℹ️ 定时任务较多 | 当前: $cron_count 个 | 可能影响: 系统负载 | 建议: 清理不必要的定时任务" fi
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script persists sensitive webhook URLs directly into a configuration file at CONFIG_FILE, which defaults to a path under /tmp when CONFIG_DIR is unset. This creates a realistic risk of credential disclosure to other local users or processes, especially if file permissions are not restricted, and /tmp is a shared, world-accessible location on many systems.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing notification message is written entirely in Chinese, including the title and operational guidance, with no indication that language is configurable or limited to a justified region-specific context. This creates a natural-language policy issue because the skill imposes a specific locale on users without opt-in.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh # === Run as Daemon === run_daemon() { nohup "$0" monitor > /dev/null 2>&1 & echo $! }
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh EOF ) curl -s -X POST "$webhook" \ -H "Content-Type: application/json" \ -d "$payload" > /dev/null 2>&1
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This shell script sends the provided title and message to an external Feishu webhook via HTTP, which can transmit user or system-generated data off-host. While the script logs success afterward, there is no prior warning, confirmation, or inline comment/docstring disclosing that message content will be sent to a third-party service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This shell script posts the title and message to an external WeCom webhook, potentially sharing operational or user data with an external service. The file does not provide a prior disclosure, confirmation, or explanatory comment making this data transmission explicit.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This shell script presents command hints and, elsewhere, help text exclusively in Chinese, which imposes a specific language on users without opt-in. The file does not indicate that the skill is intended only for a Chinese-speaking or region-specific audience, so this is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The help and usage strings from these lines are entirely Chinese-language, and the script provides no alternative language option or opt-in flow. That can violate language/locale policy when a skill is expected to be generally usable across users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The user-facing output strings in this shell script are written in Chinese, including status messages and installation guidance, with no indication that language is configurable or limited to a justified region-specific context. This violates the language/locale policy criterion because it imposes a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script includes user-facing Chinese text such as '测试' and '系统守护' with no indication that the skill is intentionally locale-specific or that users can select their preferred language. This can violate language/locale policy when a skill imposes a language without opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
At L079 the documentation explicitly says the tool only discovers issues and notifies the user, emphasizing that the user decides whether to restart. Later, L151 and L171 describe a persistent monitoring/guarding mode running in the background, which conflicts with the earlier portrayal of a passive, notification-only tool and creates intent ambiguity about autonomy.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Advertising one-click cleanup without warning that it deletes logs, caches, or temporary files normalizes a potentially destructive action as harmless. Users may trigger cleanup casually through chat, causing loss of forensic data, troubleshooting artifacts, or application state needed for recovery.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The article states that any user in any IM conversation can invoke the skill with
sg, with no mention of authorization, role checks, or trusted-chat restrictions. In a bot-connected environment, unrestricted invocation can expose sensitive system status and create a path to abuse operational commands from untrusted users.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The
sgcexample shows deletion of OpenClaw temporary files, NPM cache, and system logs while presenting it as a simple conversational command, without any safety warning or approval step. If exposed through a chat bot, this can let users erase logs or operational data remotely, undermining incident response and potentially disrupting applications.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest description is written entirely in Chinese and does not indicate that the skill is region-specific or that other language options are available. Under the language/locale policy, this can be a natural-language policy concern because it implicitly fixes the skill presentation to a specific language without user opt-in or justification.
- Content