OpenClaw Skill Auditor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:13 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent security-auditing tool, but it has review-worthy implementation issues that can expose copied code and give users stronger safety assurance than the scanner actually supports.

Install only if you understand this is a lightweight heuristic scanner, not a complete security verifier. Treat its safe results as limited, avoid running it on private/proprietary skills until the /tmp export behavior is fixed, and manually review unsupported file types plus any retained suspicious-code report files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audit.sh:181

Finding

Predictable Temporary Report Path Permits File Overwrite

Content

View full analysis

-suspicious.txt`. 3. Before the audit runs, the attacker creates that path as a symbolic link to a file writable by the auditing account. 4. The scanned Skill contains a line that causes `SUSPICIOUS_CODE` to become nonempty. 5. During L3 analysis, `cp` writes the collected content to the predictable path. 6. If the platform permits following the link, the linked destination is overwritten with attacker-influenced source text. ### Impact Assessment Exploitation may cause: - Over ...[truncated 475 chars]

Remediation

View remediation

&2 return 1 } chmod 600 "$output_file" || { rm -f -- "$output_file" return 1 } cp -- "$SUSPICIOUS_CODE" "$output_file" || { rm -f -- "$output_file" return 1 } ``` Additional hardening should include: - Registering the generated report in the exit trap unless persistence is explicitly requested. - Avoiding shared temporary directories when a private runtime directory is available. - Never deriving a security-sensitive temporary filename solely from attacker-influenced input. - Using `--` before path operands to prevent option interpretation. - Documenting when a report is deliberately retained and where it is stored. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audit.sh:224

Finding

Restricted File-Extension Allowlist Allows Malicious Content to Evade Scanning

Content

View full analysis

/dev/null) ``` ### Technical Analysis The scanner only examines files ending in `.md`, `.sh`, `.py`, or `.js`. Other files are silently excluded even when they are executable or contain instructions and code relevant to Skill behavior. The omitted set can include: - Extensionless shell scripts and executable launchers. - TypeScript, Ruby, Perl, PHP, Lua, PowerShell, or compiled executables. - YAML, JSON, TOML, and other configuration files capable of defining commands or hooks. - Alternate-case or disguised extensions. - Payloads stored as data and loaded by a scanned launcher at runtime. Because skipped files are neither reported nor reflected in verdict generation, the script can return `APPEARS SAFE` while security-relevant files remain completely uninspected. An attacker can deliberately place malicious behavior in an unsupported file type and keep the four recognized file types benign. ### Attack Path 1. An attacker creates a Skill containing malicious code in an unsupported file, such as an extensionless executable or a TypeScript file. 2. Files matching `.md`, `.sh`, `.py`, and `.js` are kept benign or contain no recognized signatures. 3. A user invokes the auditor against the Skill. 4. The `find` expression omits the malicious file without warning. 5. No finding is recorded for the omitted payload. 6. The auditor can return an `APPEARS SAFE` verdict. 7. The user installs or invokes the Skill, allowing the previously uninspected payload to execute through the Skill's normal workflow. ### Impact Assess ...[truncated 582 chars]

Remediation

View remediation

> "$FINDINGS_FILE" fi done < <(find "$skill_path" -type f -print0 2>/dev/null) ``` Content detection should be implemented carefully because `grep -I` is heuristic. Unsupported files must remain visible in the final report, and the verdict should state that the scan was incomplete. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audit.sh:111

Finding

Standalone Hex-Obfuscated Payloads Bypass the Deobfuscation Layer

Content

View full analysis

> "$SUSPICIOUS_CODE" fi ``` ```bash # === L2: Deobfuscation === deobfuscate_scan() { echo "" echo -e "${BOLD}[L2] Deobfuscation Scan${NC}" if [ ! -s "$SUSPICIOUS_CODE" ]; then echo -e " ${GREEN}No obfuscated code found${NC}" return fi # Extract and decode base64 strings while IFS= read -r line; do # Find base64-like strings (min 20 chars) b64_strings=$(echo "$line" | grep -oE '[A-Za-z0-9+/=]{20,}' | head -5) for b64 in $b64_strings; do # Try to decode decoded=$(echo "$b64" | base64 -d 2>/dev/null) if [ $? -eq 0 ] && [ -n "$decoded" ]; then # Check decoded content for threats if echo "$decoded" | grep -qiE 'curl|wget|bash|sh|eval|exec|/bin/|http://|https://'; then echo -e " ${RED}[DECODED]${NC} Hidden command found:" echo -e " ${MAGENTA}$decoded${NC}" echo "HIGH" >> "$FINDINGS_FILE" fi # Check for IPs in decoded content for ip in $MALICIOUS_IPS; do if echo "$decoded" | grep -q "$ip"; then echo -e " ${RED}[DECODED]${NC} Hidden C2 server: $ip" echo "HIGH" >> "$FINDINGS_FILE" fi done fi done # Check for hex encoded strings \x41\x42... if echo "$line" | grep -qE '\\x[0-9a-fA-F]{2}'; then hex_decoded=$(echo -e "$line" 2>/dev/null) if echo "$hex_decoded" | grep -qiE ' ...[truncated 2019 chars]

Remediation

View remediation

> "$SUSPICIOUS_CODE" fi ``` A stronger design is to run each deobfuscation detector directly while reading every scanned file: - Detect and decode Base64 and hex independently. - Do not use one encoding detector as the input gate for another. - Add tests for standalone hex payloads with no literal dangerous keywords. - Set limits on decoded size and recursion depth to avoid resource-exhaustion attacks. - Treat decoding failures and truncated analysis as explicit incomplete-scan conditions. - Avoid `echo -e` as a general-purpose decoder; parse validated consecutive `\xNN` sequences with a dedicated routine so unrelated shell-style escapes are not interpreted. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

## Maintenance

**Update this skill when new threats are discovered:**

1. New malicious IP → Add to `MALICIOUS_IPS`
2. New malicious domain → Add to `MALICIOUS_DOMAINS`

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/audit.sh (reported line 108)May include surrounding context.

sh

done
        
        # LOW RISK: Sudo
        if echo "$line" | grep -qiE '^sudo |sudo apt|sudo pip|sudo npm'; then
            echo -e "   ${GREEN}[LINE $line_num]${NC} Requires sudo"
            echo "LOW" >> "$FINDINGS_FILE"
        fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

| 🟡 Medium | Access to `~/.openclaw/` | Config theft |
| 🟡 Medium | Reads `$API_KEY` etc. | Credential leakage |
| 🟡 Medium | Social engineering keywords | User deception |
| 🟢 Low | Requires sudo | Elevated privileges |

### L2: Deobfuscation

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

| 🟡 Medium | Access to `~/.openclaw/` | Config theft |
| 🟡 Medium | Reads `$API_KEY` etc. | Credential leakage |
| 🟡 Medium | Social engineering keywords | User deception |
| 🟢 Low | Requires sudo | Elevated privileges |

### L2: Deobfuscation

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/audit.sh (reported line 108)May include surrounding context.

sh

| 🟡 Medium | Access to `~/.openclaw/` | Config theft |
| 🟡 Medium | Reads `$API_KEY` etc. | Credential leakage |
| 🟡 Medium | Social engineering keywords | User deception |
| 🟢 Low | Requires sudo | Elevated privileges |

### L2: Deobfuscation

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/audit.sh (reported line 107)May include surrounding context.

sh

fi
        done
        
        # LOW RISK: Sudo
        if echo "$line" | grep -qiE '^sudo |sudo apt|sudo pip|sudo npm'; then
            echo -e "   ${GREEN}[LINE $line_num]${NC} Requires sudo"
            echo "LOW" >> "$FINDINGS_FILE"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Comments and user-facing output label this stage as "L3: LLM Analysis" / "LLM Intent Analysis," and the banner at L277 even advertises "LLM intent analysis (Gemini)." However, the implementation merely copies suspicious code to /tmp, prints a suggested prompt in Chinese, and shows a preview; it never performs any automated LLM call or analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script copies potentially sensitive suspicious code into a predictable filename under /tmp, which can expose contents to other local users or processes and enables symlink/race-condition style abuse on multi-user systems. Because scanned skills may contain embedded secrets, proprietary code, or malicious payloads, writing them to a world-accessible temporary location without strong controls increases disclosure risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The hardcoded prompt string uses Chinese ("分析这段可疑代码") when instructing how to request agent analysis. This imposes a specific language on users without opt-in or documented locale justification, which is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.