Agent Manager

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:49 PM UTC
• Version: 1.0.0

Overview

This is a real OpenClaw agent manager, but it exposes high-impact unauthenticated APIs that run shell commands, delete files, and include a plaintext token, so it should be reviewed before installation.

Install only in a tightly controlled local environment after removing and rotating the exposed token, adding authentication, binding the server to 127.0.0.1, replacing shell exec/rm -rf with safe Node APIs or argument-array subprocess calls, validating paths and IDs, and updating vulnerable dependencies. Do not expose port 3000 to a network or run this against important OpenClaw data until those issues are fixed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (7)

T09 · Insecure Skill Coding Practices

Error

• Location: server.js:173
• Finding: Shell Command Injection in Agent Chat and Deletion Endpoints<![CDATA[ ## Vulnerability Details **File Location**: `server.js:29-34`, `server.js:173-201`, `server.js:264-278`; duplicated in `server-gemini.js:25-30`, `server-gemini.js:109-117`, and `server-gemini.js:140-150` **Vulnerability Type**: OS command injection through user-controlled shell command construction **Risk Level**: Critical ### Vulnerable Code ```javascript async function execCmd(cmd) { return new Promise((resolve, reject) => { exec(cmd, { shell: 'zsh' }, (error, stdout, stderr) => { if (error) reject(error); else resolve({ stdout, stderr }); }); }); } ``` ```javascript const agentId = id.replace('agent-', ''); const workspace = agentConfig?.workspace || `workspace-${agentId}`; const workspacePath = path.join(CONFIG.workspaceDir, workspace); // Check whether the workspace exists try { await fs.access(workspacePath); } catch (e) { return res.status(404).json({ success: false, error: `Agent 工作区不存在：${workspacePath}` }); } const safeMessage = message.replace(/"/g, '\\"').replace(/\n/g, ' '); const { stdout } = await execCmd( `cd "${workspacePath}" && openclaw agent --agent ${agentId} --message "${safeMessage}" --json 2>&1` ); ``` ```javascript app.delete('/api/agents/:id', async (req, res) => { try { const { id } = req.params; const agentDir = path.join(CONFIG.agentsDir, id); try { await fs.access(agentDir); } catch (e) { return res.status(404).json({ success: false, error: 'Agent 不存在' }); } await execCmd(`rm -rf "${agentDir}"`); ``` ### Technical Analysis The application constructs Zsh command strings containing request-controlled Agent IDs, workspace values, and chat messages. Replacing double quotes and newlines is not valid shell escaping. Shell expressions such as command substitution remain active inside double quotes, while `agentId` is inserted without shell quoting. The deletion endpoint similarly passes a request-derived path to `rm -rf` through a shell. Path ...[truncated 1171 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the generic `execCmd` shell-string interface. - Invoke `openclaw` through `execFile` or `spawn` with an explicit argument array and `shell: false`. - Set the workspace through the subprocess `cwd` option rather than executing `cd`. - Restrict Agent IDs to a narrow allowlist such as `^[a-z0-9-]+$`. - Validate workspace identifiers separately and enforce canonical path containment. - Replace shell-based `rm -rf` with `fs.rm(path, { recursive: true })`, but only after canonical containment validation. - Run the server under a dedicated, minimally privileged operating-system account. - Add authentication and authorization before exposing any command-executing endpoint. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: server.js:24
• Finding: Unauthenticated Network Access to Privileged Agent Management APIs<![CDATA[ ## Vulnerability Details **File Location**: `server.js:24-25`, `server.js:49-287`, `server.js:1239-1241`; `server-gemini.js:21-22`, `server-gemini.js:45-158`, `server-gemini.js:338-340` **Vulnerability Type**: Missing authentication and authorization with unrestricted CORS **Risk Level**: Critical ### Vulnerable Code ```javascript app.use(cors()); app.use(express.json()); ``` ```javascript app.post('/api/agents', async (req, res) => { // Creates files and registers an Agent under ~/.openclaw }); ``` ```javascript app.post('/api/agents/:id/chat', async (req, res) => { // Invokes the OpenClaw Agent command }); ``` ```javascript app.delete('/api/agents/:id', async (req, res) => { // Recursively deletes an Agent directory }); ``` ```javascript app.listen(PORT, () => { console.log(`🚀 Agent Manager 运行在 http://localhost:${PORT}`); console.log(`📡 API 端点：http://localhost:${PORT}/api`); }); ``` ### Technical Analysis No authentication or authorization middleware protects Agent enumeration, creation, chat execution, or deletion. The default `cors()` configuration permits arbitrary web origins to issue readable cross-origin requests. Calling `app.listen(PORT)` without a host does not enforce loopback-only access. Although console output and documentation describe the service as localhost-based, the implementation does not explicitly bind it to `127.0.0.1`. The exposed operations are privileged because they modify `~/.openclaw`, execute the OpenClaw CLI, and recursively delete Agent directories. ### Attack Path 1. The user starts either documented server. 2. A malicious website, local process, container, or reachable network client connects to port 3000. 3. The attacker calls `GET /api/agents` to enumerate configured Agents. 4. The attacker calls `POST /api/agents`, `POST /api/agents/:id/chat`, or `DELETE /api/agents/:id`. 5. The server performs the operation without verifying the caller's identity or authority. 6. Permissive CORS allows a m ...[truncated 450 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require authentication for every API endpoint other than a minimal health check. - Enforce authorization per operation, particularly for Agent creation, command invocation, and deletion. - Bind to `127.0.0.1` explicitly unless remote deployment is intentionally configured. - Replace unrestricted CORS with an explicit allowlist of trusted origins. - Add CSRF protection if browser cookies or other ambient credentials are used. - Require reauthentication or explicit confirmation for destructive operations. - Add rate limiting, request auditing, and security event logging. - Do not rely on a localhost URL in documentation as an access-control boundary. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: server.js:90
• Finding: Path Traversal in Agent File Creation, Workspace Selection, and Recursive Deletion<![CDATA[ ## Vulnerability Details **File Location**: `server.js:90-150`, `server.js:173-191`, `server.js:264-278`; similar logic in `server-gemini.js:61-84`, `server-gemini.js:101-109`, and `server-gemini.js:140-150` **Vulnerability Type**: Improper path validation and filesystem root escape **Risk Level**: Critical ### Vulnerable Code ```javascript const { name, description, model, workspace } = req.body; if (!name) { return res.status(400).json({ success: false, error: '名称必填' }); } const agentId = `agent-${name.toLowerCase().replace(/\s+/g, '-')}`; const agentDir = path.join(CONFIG.agentsDir, agentId); await fs.mkdir(agentDir, { recursive: true }); const agentConfig = { id: agentId, name, description: description || '', model: model || 'bailian/qwen3.5-plus', workspace: workspace || `workspace-${name.toLowerCase()}`, createdAt: new Date().toISOString(), status: 'active' }; await writeJsonFile(path.join(agentDir, 'config.json'), agentConfig); await fs.writeFile(path.join(agentDir, 'IDENTITY.md'), `# IDENTITY.md - ${name} - **Name:** ${name} - **Role:** Agent - **Vibe:** 专业、高效、友好 `); ``` ```javascript const agentConfigPath = path.join(CONFIG.agentsDir, id, 'config.json'); const agentId = id.replace('agent-', ''); const workspace = agentConfig?.workspace || `workspace-${agentId}`; const workspacePath = path.join(CONFIG.workspaceDir, workspace); ``` ```javascript const { id } = req.params; const agentDir = path.join(CONFIG.agentsDir, id); await execCmd(`rm -rf "${agentDir}"`); ``` ### Technical Analysis Request-controlled names, IDs, and workspace values are passed to `path.join` without validating their syntax or checking the resolved path against the intended root. Replacing whitespace in a name does not remove path separators or traversal components. `path.join` normalizes `..` components; it does not guarantee that the result remains below `CONFIG.agentsDir` or `CONFIG.workspaceDir`. Consequently, crafted values can redirect file ...[truncated 1075 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Define strict schemas for names, Agent IDs, and workspace identifiers. - Reject path separators, traversal components, control characters, and unexpected Unicode forms. - Resolve each candidate path with `path.resolve`. - Resolve the configured root once and verify that every candidate starts with the canonical root plus the platform path separator. - Do not accept an arbitrary workspace path from an API request; select workspaces from a server-managed allowlist. - Avoid following symbolic links during sensitive filesystem operations. - Use `fs.rm` rather than shell-based deletion, after validating the target and refusing deletion of the root itself. - Add tests for encoded traversal, repeated traversal, absolute paths, mixed separators, and symlink escapes. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: server.js:18
• Finding: Plaintext OpenClaw Operator Token Committed to Source and Documentation<![CDATA[ ## Vulnerability Details **File Location**: `server.js:18-22`; duplicated in `README.md:39-47` **Vulnerability Type**: Hardcoded privileged credential **Risk Level**: High ### Vulnerable Code ```javascript const CONFIG = { openclawGateway: 'http://127.0.0.1:18789', openclawToken: 'ZZitPPb3LZmDH2c_jYl9Xbub2NO1CrqntpGgF-LBEGM', agentsDir: path.join(process.env.HOME, '.openclaw/agents'), workspaceDir: path.join(process.env.HOME, '.openclaw') }; ``` The same token is included in the documented configuration example: ```json { "openclawGateway": "http://127.0.0.1:18789", "openclawToken": "ZZitPPb3LZmDH2c_jYl9Xbub2NO1CrqntpGgF-LBEGM", "port": 3000 } ``` ### Technical Analysis A value represented as an OpenClaw operator token is embedded directly in executable source and public project documentation. Source control, package distribution, backups, build artifacts, and logs can all preserve the secret even after it is removed from the latest file version. Static review cannot determine whether the token remains valid. Because it has been disclosed, it must be treated as compromised. ### Attack Path 1. An attacker obtains the source package, repository history, archive, or documentation. 2. The attacker extracts the operator token. 3. The attacker attempts to authenticate to the associated OpenClaw Gateway. 4. If the token remains valid and the Gateway is reachable, the attacker exercises the token's operator privileges. ### Impact Assessment Potential impact includes unauthorized access to privileged OpenClaw Gateway functions, depending on token validity, configured permissions, and network reachability. Disclosure also prevents reliable attribution because legitimate and unauthorized users may share the same static credential. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Revoke and rotate the exposed token immediately. - Remove the token from source files, documentation, package archives, and repository history where feasible. - Load credentials from protected environment variables or an operating-system secret store. - Ensure secret-bearing files are excluded from version control and distributed packages. - Use separate, narrowly scoped credentials for development and production. - Add automated secret scanning to commits and release pipelines. - Review Gateway logs for use of the disclosed token. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: index.html:287
• Finding: Stored Cross-Site Scripting Through Agent Metadata<![CDATA[ ## Vulnerability Details **File Location**: `index.html:287-314`, `index.html:351-371`; equivalent rendering in `server-gemini.js:321-325` and the embedded UI in `server.js:994-1070` **Vulnerability Type**: Stored cross-site scripting through unsafe `innerHTML` and inline event-handler construction **Risk Level**: High ### Vulnerable Code ```javascript async function loadAgents() { try { const response = await fetch(API_BASE + '/agents'); const data = await response.json(); agents = data.registered || []; const listEl = document.getElementById('agentList'); if (agents.length === 0) { listEl.innerHTML = '<div style="padding:20px;color:#666;text-align:center">暂无 Agent</div>'; return; } let html = ''; for (let i = 0; i < agents.length; i++) { const agent = agents[i]; const key = agent.id.replace('agent-', ''); const emoji = agentEmojis[key] || '🤖'; const active = agent.id === currentAgentId ? 'active' : ''; html += '<div class="agent-item ' + active + '" onclick="selectAgent(\'' + agent.id + '\')">'; html += '<div class="agent-name">'; html += '<span class="agent-emoji">' + emoji + '</span>' + agent.name; html += '</div>'; html += '<div class="agent-desc">' + (agent.description || '') + '</div>'; html += '</div>'; } listEl.innerHTML = html; ``` Additional unescaped metadata is used when rendering history: ```javascript const msgAgentName = m.agentName || agent.name; const msgAgentEmoji = m.agentEmoji || emoji; const header = m.type === 'user' ? '你' : (msgAgentEmoji + ' ' + msgAgentName); html += '<div class="message ' + m.type + '">'; html += '<div class="message-header">' + header + '</div>'; html += '<div class="message-content">' + escapeHtml(m.content) + '</div>'; html += imgHtml; html += '<div class="message-time">' + m.time + '</div>'; html += '</div>'; chatMessages.innerHTML = html; ``` ### Technical Analysis Agent IDs, n ...[truncated 1396 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Stop constructing UI elements through string concatenation and `innerHTML`. - Create elements with `document.createElement` and assign untrusted values through `textContent`. - Replace inline `onclick` attributes with `addEventListener`. - Validate Agent IDs, names, and descriptions on the server before persistence. - If rich HTML is genuinely required, sanitize it with a maintained, context-appropriate sanitizer. - Apply a restrictive Content Security Policy that disallows inline scripts and inline event handlers. - Treat all values loaded from `localStorage` as untrusted. - Add regression tests using malicious HTML and JavaScript-context payloads. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: cli.js:41
• Finding: Local Shell Injection in CLI and Registration HTTP Wrappers<![CDATA[ ## Vulnerability Details **File Location**: `cli.js:18-33`, `cli.js:41-53`, `cli.js:85-143`; duplicated in `register-existing.js:57-69` **Vulnerability Type**: Command injection through JSON embedded in a shell-based `curl` command **Risk Level**: High ### Vulnerable Code ```javascript async function simpleFetch(endpoint, options = {}) { const { execSync } = require('child_process'); const url = API_BASE + endpoint; const method = options.method || 'GET'; let cmd = `curl -s -X ${method} "${url}"`; if (options.body) { cmd += ` -H "Content-Type: application/json" -d '${JSON.stringify(options.body)}'`; } try { const result = execSync(cmd, { encoding: 'utf-8', shell: 'zsh' }); return JSON.parse(result); } catch (error) { console.error('API 调用失败:', error.message); return { success: false, error: error.message }; } } ``` User input reaches this function through operations such as: ```javascript async create(name, description, model) { const data = await simpleFetch('/agents', { method: 'POST', body: { name, description, model: model || 'bailian/qwen3.5-plus' } }); } ``` ```javascript const data = await simpleFetch(`/agents/${agentId}/chat`, { method: 'POST', body: { message } }); ``` The same unsafe pattern exists in `register-existing.js`: ```javascript let cmd = `curl -s -X ${method} "${url}"`; if (options.body) { cmd += ` -H "Content-Type: application/json" -d '${JSON.stringify(options.body)}'`; } const result = execSync(cmd, { encoding: 'utf-8', shell: 'zsh' }); ``` ### Technical Analysis JSON data is enclosed in single quotes inside a command string. JSON serialization does not escape characters for Zsh. A single quote in a user-provided Agent name, description, model, or chat message terminates the shell-quoted body, after which shell syntax can be interpreted. The unused `fetchAPI` implementation in `cli.js:18-33` contains the same construction and should also be removed rather than ...[truncated 790 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the shell-based `curl` wrapper with Node's native `fetch` or `http`/`https` APIs. - Pass request bodies directly as strings to the HTTP client without involving a shell. - Remove the duplicate and unused unsafe `fetchAPI` implementation. - If a subprocess is unavoidable, use `execFile` or `spawn` with an argument array and `shell: false`. - Validate Agent IDs before incorporating them into URL paths. - Add tests containing quotes, backticks, command substitutions, newlines, and shell metacharacters. ]]>

T08 · Insecure Dependencies

Warning

• Location: package-lock.json:19
• Finding: Dependencies Locked to a Third-Party Package Registry Mirror<![CDATA[ ## Vulnerability Details **File Location**: `package-lock.json:19`, `package-lock.json:134-136`, `package-lock.json:255`, `package-lock.json:550`, with similar `resolved` entries throughout the lockfile **Vulnerability Type**: Expanded software supply-chain trust through a third-party dependency source **Risk Level**: Medium ### Vulnerable Code Representative lockfile entries include: ```json "resolved": "https://registry.npmmirror.com/accepts/-/accepts-1.3.8.tgz" ``` ```json "node_modules/cors": { "version": "2.8.6", "resolved": "https://registry.npmmirror.com/cors/-/cors-2.8.6.tgz" } ``` ```json "resolved": "https://registry.npmmirror.com/express/-/express-4.22.1.tgz" ``` ```json "resolved": "https://registry.npmmirror.com/node-fetch/-/node-fetch-2.7.0.tgz" ``` The manifest also permits compatible dependency upgrades: ```json "dependencies": { "express": "^4.18.2", "cors": "^2.8.5", "node-fetch": "^2.7.0", "uuid": "^9.0.0" } ``` ### Technical Analysis The lockfile directs installations to `registry.npmmirror.com` rather than the official npm registry. This introduces an additional package-distribution trust boundary. A compromise, stale artifact, or divergence at that mirror could affect dependency installation. No malicious dependency, install lifecycle script, typosquatted package, or integrity bypass was confirmed during this audit. The finding concerns the avoidable increase in supply-chain exposure rather than evidence that the listed packages are currently malicious. ### Attack Path 1. A user follows the documentation and runs `npm install` or `npm ci`. 2. npm reads the third-party `resolved` URLs from the lockfile. 3. Dependency archives are retrieved from the mirror. 4. If the mirror serves a compromised or divergent artifact that passes the applicable installation checks, malicious dependency code enters the application environment. 5. The dependency code executes when imported or through any package lifecycle behavi ...[truncated 294 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Regenerate the lockfile using an organization-approved registry. - Prefer the official npm registry unless a vetted internal mirror is required. - Preserve and verify lockfile integrity hashes. - Use `npm ci` for reproducible deployment installations. - Pin direct dependency versions where strict reproducibility is required. - Run dependency vulnerability, provenance, and license checks in CI. - Review lockfile changes during code review, especially registry-host and integrity-field changes. - Continue prohibiting unnecessary install lifecycle scripts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (58)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The finding reports hardcoded authentication material and undisclosed execution of shell/OpenClaw commands alongside local probing. Hardcoded tokens are especially dangerous because they can leak credentials, enable unauthorized agent operations, and indicate poor secret-handling practices; combined with misleading documentation, this significantly raises the risk profile.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The finding reports hardcoded authentication material and undisclosed execution of shell/OpenClaw commands alongside local probing. Hardcoded tokens are especially dangerous because they can leak credentials, enable unauthorized agent operations, and indicate poor secret-handling practices; combined with misleading documentation, this significantly raises the risk profile.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The finding reports hardcoded authentication material and undisclosed execution of shell/OpenClaw commands alongside local probing. Hardcoded tokens are especially dangerous because they can leak credentials, enable unauthorized agent operations, and indicate poor secret-handling practices; combined with misleading documentation, this significantly raises the risk profile.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The finding reports hardcoded authentication material and undisclosed execution of shell/OpenClaw commands alongside local probing. Hardcoded tokens are especially dangerous because they can leak credentials, enable unauthorized agent operations, and indicate poor secret-handling practices; combined with misleading documentation, this significantly raises the risk profile.

Ae1

High

• Category: analysis-evasion

Content

在 `server-gemini.js` 中，使用参数化命令:

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Known Vulnerable Dependency: path-to-regexp==0.1.12 — 1 advisory(ies): CVE-2024-45296 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple r)

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: path-to-regexp 0.1.12 is a transitive dependency of express routing, and the cited CVE describes Regular Expression Denial of Service. In a network-facing multi-agent management platform with chat and upload features, attacker-controlled paths or route matching can turn this into a practical remote service exhaustion issue.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The server exposes a generic shell execution helper using `child_process.exec` with a real shell (`zsh`), and later uses it on request-derived data in chat and deletion flows. In an agent-management web service, this creates an unnecessary command-invocation surface where quoting mistakes, future code changes, or path/id manipulation can turn into command injection or unintended command execution.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Agent deletion is performed by constructing and running `rm -rf` through the shell. Even though the path is quoted, invoking destructive filesystem operations via a shell is unnecessarily dangerous in a network-exposed management service and increases the blast radius of any path-validation failure or future injection bug.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: A destructive delete endpoint removes agent data immediately with no authentication, confirmation token, or safety interlock visible in the server code. In a management UI context, silent irreversible deletion increases the risk of accidental or unauthorized data loss, especially because CORS is enabled and the endpoint is network accessible.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: A hard-coded OpenClaw token is embedded directly in source code, making it recoverable by anyone with access to the skill package, repository, logs, or backups. If valid, the token could enable unauthorized access to internal OpenClaw services or agent operations, and the skill context increases risk because this server is explicitly designed to manage agents and workspaces.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

});

/**
 * DELETE /api/agents/:id - 删除 Agent
 */
app.delete('/api/agents/:id', async (req, res) => {
  try {

• Confidence: 98% confidence
• Finding: The API accepts attacker-controlled agent IDs and feeds them into shell-based operations, especially in the delete flow using execCmd(`rm -rf "${agentDir}"`) and in chat flow via shell command construction. Because path components derived from route parameters can include traversal sequences and shell metacharacters may not be safely handled by manual quoting, an attacker may delete arbitrary directories or execute unintended commands, which is especially severe in a local agent/workspace management service.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The deletion endpoint performs irreversible filesystem removal of an agent directory with no authentication, authorization, CSRF protection, or server-side safety checks. In this management-skill context, exposing destructive operations over a broadly accessible API makes unauthorized data loss much more dangerous than a mere missing confirmation dialog.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs users to extract an Operator Token from a local credential store and place it into a plain `config.json` file, but it does not warn that this token is sensitive or describe secure handling practices. This increases the risk of credential leakage through source control, backups, screenshots, shared skill bundles, or local file disclosure, which could allow unauthorized access to the OpenClaw gateway as the operator.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This markdown file documents agent deletion as a feature, but it does not warn that deleting an agent may remove its registration and associated workspace data or otherwise be irreversible. Under the markdown-specific warning rule, destructive behaviors that can affect user data should be clearly disclosed.

Session Persistence

Medium

• Category: Rogue Agent

Content

node cli.js list

# 创建新 Agent
node cli.js create Judy "营销外展专家" bailian/qwen3.5-plus

# 与 Agent 对话
node cli.js chat agent-judy

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quickstart presents `node cli.js delete agent-judy` as a normal usage example, but gives no warning that it performs a destructive action. In markdown documentation, commands that may delete user-managed resources should include a clear caution about consequences.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 获取 Agent 列表
```bash
curl http://localhost:3000/api/agents
```

### 创建 Agent

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The DELETE endpoint example documents a destructive operation but omits any warning about its effect on user data or system state. Markdown guidance should disclose potentially harmful actions so users understand the impact before invoking them.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: Nearly all user-facing documentation in this file is presented in Chinese, and the skill does not indicate that users may choose another language or that the locale restriction is intentional and justified. This can violate language/locale policy when a specific language is imposed without user opt-in.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This markdown file advertises a delete/deactivate capability, but it does not include any warning that the action may be destructive or irreversible. Under the markdown-specific warning rule, user-facing documentation should disclose behaviors that can affect user data or system integrity.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The API section exposes a DELETE operation for `/api/agents/:id`, but the documentation provides no caution about its destructive nature. For markdown files, operations affecting user data or managed resources should include a clear warning so users understand the potential impact.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The README includes a concrete OpenClaw token directly in the example configuration, which trains users to embed live credentials in a local file and risks accidental reuse of a real secret. Even if intended as a sample, hardcoded tokens are commonly copied into deployments, committed to repos, or exposed via screenshots and support logs, enabling unauthorized access to the gateway.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no explicit tool scope or permissions even though the documentation indicates capabilities involving shell execution, local filesystem access, environment/config access, and likely network/local API interaction. This is dangerous because users and platforms cannot accurately assess or constrain what the skill may do, increasing the risk of over-privileged execution and unexpected access to sensitive local OpenClaw data.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The claimed shell-execution fix is not actually safe: it still uses child_process.exec with a shell command string that interpolates agentId. If agentId can be influenced by a user or external input, this can lead to command injection and arbitrary command execution on the host.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to print the Operator token directly from a local file without emphasizing that it is a sensitive credential. This increases the chance of accidental disclosure through terminal history, screenshots, logs, copy/paste into chats, or shoulder surfing, potentially enabling unauthorized access to OpenClaw operations.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.install_untrusted_source

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: cli.js:13

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: register-existing.js:51

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: server-gemini.js:27

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: server.js:31

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: server-gemini.js:14

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: server.js:15

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config.json:2