ClawHub
Back to skill

Security audit

Security Audit

Security checks for vulnerabilities and agentic risk

Overview

This skill is an OpenClaw security-audit wrapper, but it downloads and runs unpinned external Bash scripts that were not included in the reviewed artifact.

Install only if you trust the external GitHub repository and are comfortable reviewing or pinning the scripts before running them. Treat the read-only checks and especially the fix scripts as local code execution with access to OpenClaw configuration, credentials, network details, and user-writable files.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:51
Finding

Unreviewed Remote Payload Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51–104
Vulnerability Type: Remote code retrieval and execution
Risk Level: Critical

The Skill instructs the Agent to clone a mutable external GitHub repository and execute several Bash scripts obtained from that repository.

bash
git clone https://github.com/sunt23310-ops/openclaw-security-audit.git ~/openclaw-security-audit
bash
AUDIT_DIR="$HOME/openclaw-security-audit"
bash
bash "$AUDIT_DIR/checks/gateway.sh" && bash "$AUDIT_DIR/checks/credentials.sh"
bash
for check in gateway credentials channels tools network system; do
  bash "$AUDIT_DIR/checks/${check}.sh"
done
bash
bash "$AUDIT_DIR/fixes/interactive-fix.sh"
bash
bash "$AUDIT_DIR/fixes/gateway-fix.sh"
bash "$AUDIT_DIR/fixes/permission-fix.sh"
bash "$AUDIT_DIR/fixes/channel-fix.sh"
bash
bash "$AUDIT_DIR/audit.sh"

Technical Analysis

The effective executable payload is not included in the audited project. Instead, it is retrieved at runtime from the default branch of an external repository. The instructions do not pin an immutable commit, verify a cryptographic hash or publisher signature, or require inspection of the downloaded scripts before execution.

Consequently, the behavior reviewed in SKILL.md is not necessarily the behavior that will execute later. The repository owner—or an attacker who compromises the repository, maintainer account, or relevant delivery path—can replace the referenced scripts after this Skill has been reviewed.

The downloaded scripts are invoked directly through Bash. They therefore execute with the permissions of the user running the Agent and can perform operations beyond the stated security-audit purpose. The claim that the tool is read-only by default cannot be independently validated because the implementation is absent from the project.

Attack Path

  1. An attac ...[truncated 1429 chars]
Remediation
View remediation

Remediation Suggestions

  1. Bundle the complete, reviewed audit implementation inside the Skill package so that the audited content is identical to the executed content.
  2. If external retrieval is unavoidable, pin the repository to a specific immutable commit rather than cloning the mutable default branch.
  3. Publish expected SHA-256 hashes for every executable file and verify them before execution. Abort on any mismatch.
  4. Require cryptographically signed commits or release artifacts and validate signatures against an explicitly trusted maintainer key.
  5. Display or statically inspect downloaded scripts before execution, including recursively referenced scripts and binaries.
  6. Execute checks in a restricted sandbox with minimal filesystem access, no unnecessary credentials, and network access disabled unless a particular check explicitly requires it.
  7. Separate read-only checks from mutation-capable fixes. Require explicit, informed confirmation immediately before every state-changing action.
  8. Never elevate downloaded code directly. If privileged changes are necessary, use a small, bundled, reviewed helper with a narrowly defined interface.
  9. Document all files, commands, network destinations, and sensitive resources that each check may access.

T08 · Insecure Dependencies

Error
Location
SKILL.md:51
Finding

Unpinned Third-Party Supply-Chain Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51–54
Vulnerability Type: Unsafe and unpinned third-party dependency
Risk Level: High

The installation process clones a third-party Git repository without selecting a fixed version or validating the retrieved content.

bash
git clone https://github.com/sunt23310-ops/openclaw-security-audit.git ~/openclaw-security-audit

Technical Analysis

A plain git clone retrieves the repository's current default branch. That branch is mutable, so two installations performed at different times may receive materially different code despite using the same Skill version.

No commit identifier, signed tag, release version, checksum, lock file, or provenance record constrains the dependency. Trust is therefore delegated to the current state of the upstream repository and the security of its maintainer accounts. This creates a supply-chain boundary that the project does not authenticate beyond transport to GitHub.

This issue compounds the direct execution finding because the unpinned dependency contains the scripts that the Skill subsequently invokes. Even a legitimate upstream update can introduce vulnerabilities or behavior that was not evaluated during this project audit.

Attack Path

  1. The upstream project publishes a compromised update, or an attacker gains control of the repository or a maintainer account.
  2. The current default branch is changed to include unsafe or malicious components.
  3. A new user follows the Skill's setup instructions.
  4. git clone retrieves the changed default branch without warning that it differs from the version originally reviewed.
  5. The altered dependency is accepted without hash or signature verification.
  6. The Skill's subsequent commands execute the altered components.

Impact Assessment

The dependency compromise can affect every later installation that retrieves the modified branch. Because the dependency s ...[truncated 477 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a specific reviewed commit hash.
  2. Prefer a versioned release artifact accompanied by a published SHA-256 checksum and a trusted digital signature.
  3. Verify the commit or artifact before placing any executable content in the user's environment.
  4. Fail closed if the expected commit, checksum, signature, or provenance information cannot be validated.
  5. Record the approved dependency version in SKILL.md and update it only through a documented security-review process.
  6. Avoid automatically tracking branches or tags that maintainers can move after publication.
  7. Vendor the reviewed scripts into the project where feasible, making their complete contents available during Skill review.
  8. Perform recurring dependency review for ownership changes, compromised releases, newly introduced executable files, and unexpected network behavior.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.