ClawHub
Back to skill

Security audit

Agent Security Monitor

Security checks for vulnerabilities and agentic risk

Overview

This security-monitoring skill is not malicious, but it reads sensitive local files more broadly than its permissions and controls clearly support.

Review before installing. This skill stays local and I found no network exfiltration or destructive behavior, but it can inspect secret files, SSH key metadata, recent shell history, and OpenClaw logs, then write findings to local log files. Only run it in an environment where that level of inspection is acceptable, and do not rely on its config file to disable sensitive checks without fixing the script first.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/security-monitor.sh:280
Finding

Undeclared access to SSH keys, shell history, and sensitive OpenClaw files

Content
View full analysis
/dev/null; then # Check if it's a placeholder or masked value local count=$(grep -c "$pattern" "$env_file") for ((i=0; i/dev/null) ``` ```bash # Check for SSH keys with weak permissions while IFS= read -r -d '' ssh_file; do local perms=$(stat -c "%a" "$ssh_file" 2>/dev/null || echo "000") if [ "$perms" != "600" ] && [ "$perms" != "400" ]; then found_insecure=true alert MEDIUM "insecure_ssh_perms" "Insecure permissions on $ssh_file: $perms (should be 600 or 400)" fi done < <(find "$HOME/.ssh" -name "id_*" -o -name "*.pem" 2>/dev/null || true) ``` ```bash local history_file="$HOME/.bash_history" if [ -f "$history_file" ]; then # Check last 50 commands local recent=$(tail -n 50 "$history_file") ``` ```bash done < <(find "$HOME/.openclaw" -name "*.log" -mtime -7 -type f 2>/dev/null || true) ``` The permission manifest declares only the following filesystem access: ```json "fil ...[truncated 2289 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/security-monitor.sh:481
Finding

Configuration switches are ignored and cannot disable sensitive checks

Content
View full analysis
"$CONFIG_FILE" << EOF { "checks": { "env_files": true, "api_keys": true, "ssh_keys": true, "unverified_skills": true, "log_sanitization": true }, "alerts": { "email": false, "log_file": true, "moltbook_post": false }, "baseline": { "last_scan": null, "known_benign_patterns": [] } } EOF fi ``` However, every check is invoked unconditionally: ```bash main() { echo "" echo -e "${GREEN}🔒 Agent Security Monitor${NC}" echo "" # Run all checks check_env_files check_unverified_skills check_insecure_keys check_command_history check_log_files check_unsigned_executables check_network_connections update_baseline print_summary } ``` ### Technical Analysis The advertised `checks` and `alerts` settings are never read before the corresponding functions execute. Consequently, changing `ssh_keys`, `env_files`, or `log_sanitization` to `false` does not reduce filesystem access. The script also has no documented configuration switch for command-history inspection. This is a security-boundary failure because users may rely on the configuration file to opt out of sensitive inspection. The implementation silently performs broader access than the configuration indicates. ### Attack Path 1. A user sets a sensitive check, such as `ssh_keys` or `env_files`, to `false`. 2. The user runs the monitor believing that access has been disabled. 3. `main` invokes every check without consulting the configuration. 4. The sensitive filesystem scan still occurs under the user's account. 5. Results and sensitive paths may be written to local logs desp ...[truncated 447 chars]
Remediation
View remediation
/dev/null } check_enabled "env_files" && check_env_files check_enabled "ssh_keys" && check_insecure_keys check_enabled "log_sanitization" && check_log_files ``` 3. Add explicit configuration options for command-history inspection, network-log inspection, unsigned executable checks, and Git checks. 4. Fail closed if the configuration is missing, malformed, unreadable, or contains values other than booleans. 5. Honor `alerts.log_file` before writing alert records. 6. Display an execution plan listing all enabled checks and paths before scanning begins. 7. Add automated tests proving that each `false` setting prevents the relevant function and filesystem access. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/security-monitor.sh:123
Finding

Incorrect file delimiters cause credential and environment checks to be skipped

Content
View full analysis
/dev/null; then local count=$(grep -c "$pattern" "$env_file") for ((i=0; i/dev/null) ``` ```bash while IFS= read -r -d '' ssh_file; do local perms=$(stat -c "%a" "$ssh_file" 2>/dev/null || echo "000") if [ "$perms" != "600" ] && [ "$perms" != "400" ]; then found_insecure=true alert MEDIUM "insecure_ssh_perms" "Insecure permissions on $ssh_file: $perms (should be 600 or 400)" fi done < <(find "$HOME/.ssh" -name "id_*" -o -name "*.pem" 2>/dev/null || true) ``` ### Technical Analysis Both loops use `read -d ''`, which expects each input record to be terminated by a NUL byte. The corresponding `find` commands emit newline-delimited paths because they omit `-print0`. Under normal conditions, `read -d ''` reaches end-of-file without finding the requested delimiter, returns failure, and the loop body does not process the discovered files. The `find` expressions also omit parentheses around their `-o` predicates. Explicit grouping is required to make the intended selection logic clear and to avoid precedence errors when additional predicates are ...[truncated 1158 chars]
Remediation
View remediation
/dev/null ) while IFS= read -r -d '' ssh_file; do # Inspect metadata only. done < <( find "$HOME/.ssh" -type f \ \( -name "id_*" -o -name "*.pem" \) -print0 2>/dev/null ) ``` 3. Track the number of files discovered and successfully inspected separately. 4. Never report a clean result when enumeration or parsing fails; report the scan as incomplete instead. 5. Add tests for zero files, multiple files, spaces, newlines, glob characters, unreadable paths, and missing directories. 6. Use portable permission checks where macOS support is claimed, because `stat -c` is GNU-specific. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/security-monitor.sh:18
Finding

Overbroad benign-pattern allowlist can suppress detection of exfiltration commands

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:6
Finding

Unnecessary unpinned Node package introduces avoidable supply-chain exposure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (22)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 72)May include surrounding context.

  1. Make the script executable:

    bash
    chmod +x ~/openclaw/workspace/skills/agent-security-monitor/scripts/security-monitor.sh

  2. Run the monitor:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
- Identifies skills without `SKILL.md` documentation

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security-monitor.sh (reported line 25)May include surrounding context.

sh
declare -A KNOWN_BENIGN=(
    # Documentation examples
    ["curl.*\."]="doc_example"
    ["cat.*\.env"]="dev_command"
    ["grep.*key"]="diagnostic"
    ["echo.*secret"]="example_code"
    # Placeholder patterns

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security-monitor.sh (reported line 311)May include surrounding context.

sh
declare -A KNOWN_BENIGN=(
    # Documentation examples
    ["curl.*\."]="doc_example"
    ["cat.*\.env"]="dev_command"
    ["grep.*key"]="diagnostic"
    ["echo.*secret"]="example_code"
    # Placeholder patterns

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security-monitor.sh (reported line 312)May include surrounding context.

sh
declare -A KNOWN_BENIGN=(
    # Documentation examples
    ["curl.*\."]="doc_example"
    ["cat.*\.env"]="dev_command"
    ["grep.*key"]="diagnostic"
    ["echo.*secret"]="example_code"
    # Placeholder patterns

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security-monitor.sh (reported line 313)May include surrounding context.

sh
declare -A KNOWN_BENIGN=(
    # Documentation examples
    ["curl.*\."]="doc_example"
    ["cat.*\.env"]="dev_command"
    ["grep.*key"]="diagnostic"
    ["echo.*secret"]="example_code"
    # Placeholder patterns

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security-monitor.sh (reported line 115)May include surrounding context.

sh
esac
}

# Check 1: Exposed secrets in .env files
check_env_files() {
    log INFO "Checking for exposed secrets in .env files..."

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security-monitor.sh (reported line 117)May include surrounding context.

sh
esac
}

# Check 1: Exposed secrets in .env files
check_env_files() {
    log INFO "Checking for exposed secrets in .env files..."

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

At this point the script begins enumerating .env and secret-named files under the user's workspace and reading them for secret patterns. For a security-monitoring tool this behavior is functionally aligned with its purpose, but it still handles highly sensitive material and can expand exposure if results are logged, alerted, or run without clear consent.

Content

Scanner excerpt · scripts/security-monitor.sh (reported line 133)May include surrounding context.

sh
"OPENAI_API_KEY"
    )

    # Scan workspace for .env files
    while IFS= read -r -d '' env_file; do
        log INFO "Scanning $env_file"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/security-monitor.sh (reported line 315)May include surrounding context.

sh
"cat.*\.env"
        "cp.*\.env"
        "rm -rf .*openclaw"
        "chmod 777"
        "chmod 775 .*\.sh"
        "curl.*webhook\.site"
        "wget.*\|.*sh"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README explicitly says the tool scans sensitive artifacts such as .env files and command history, but it does not clearly warn users that this may collect, display, or retain private data. In a security-monitoring skill, this omission is more dangerous because users may run it broadly under the assumption that it is purely protective, without understanding the privacy implications of scanning and logging highly sensitive material.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

  1. Copy this skill to your OpenClaw workspace:
    bash
    mkdir -p ~/openclaw/workspace/skills/agent-security-monitor
# Copy skill files to this directory

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises and instructs shell-based execution of a monitoring script, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: users and orchestration systems cannot easily evaluate or constrain what the skill is allowed to access, despite it claiming to scan secrets, SSH keys, logs, and shell history.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description says it scans highly sensitive local data sources such as .env files, secrets files, SSH keys, and command history, but it does not clearly warn users about the privacy implications of that access. In a security-monitoring context this behavior is expected, but without explicit disclosure and consent language, users may expose secrets or personal activity data to the skill unknowingly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill states that all scans and alerts are recorded to log files, but it does not warn that those logs may themselves contain sensitive findings, filenames, command fragments, or partial secret material. For a tool that inspects credentials and shell history, insecure retention or broad readability of logs can become a secondary data-leak channel.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

  1. Copy this skill to your OpenClaw workspace:

    bash
    mkdir -p ~/openclaw/workspace/skills/agent-security-monitor

  2. Run the monitor:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script scans sensitive log files and shell history without presenting any user-facing notice, consent, or scope limitation. Even if intended for security monitoring, silently reading high-sensitivity sources can expose credentials and behavioral data, and may violate least-privilege expectations for an agent skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script reads the user's recent shell history from ~/.bash_history and inspects commands, which is a sensitive surveillance behavior extending beyond narrow skill-directory monitoring. Command history can contain secrets, internal workflow details, or unrelated personal activity, so collecting and processing it increases privacy and data-exposure risk if logs or alerts are later accessed by others.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/security-monitor.sh (reported line 315)May include surrounding context.

sh
"cat.*\.env"
        "cp.*\.env"
        "rm -rf .*openclaw"
        "chmod 777"
        "chmod 775 .*\.sh"
        "curl.*webhook\.site"
        "wget.*\|.*sh"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/security-monitor.sh (reported line 316)May include surrounding context.

sh
"cp.*\.env"
        "rm -rf .*openclaw"
        "chmod 777"
        "chmod 775 .*\.sh"
        "curl.*webhook\.site"
        "wget.*\|.*sh"
    )

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file documentation states there are no external dependencies beyond bash and common tools, yet later code conditionally requires jq for manifest processing and also invokes multiple non-bash utilities. In particular, jq is treated as optional but is still an external dependency, making the comment materially misleading about operational requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script creates directories and automatically creates or overwrites configuration-related files such as the default config and baseline-updated config. These filesystem modifications happen automatically, but the file does not clearly warn users up front that it will create and modify files under ~/.config and ~/.openclaw.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/security-monitor.sh:184