ClawHub
Back to skill

Security audit

openclaw-upgrade

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent OpenClaw upgrade helper, but it should be reviewed carefully because it performs high-impact package, gateway, scheduled-task, and secret-backup operations with weak safeguards.

Install only if you are comfortable allowing this skill to replace a global OpenClaw package, restart the gateway, inspect local account layout, and create temporary scheduled execution artifacts. Before use, pin and verify the target version and registry, fix the hard-coded Windows path, clean up the scheduled task/script, avoid broad chmod 1777 changes, and protect or remove .env backups after rollback risk has passed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)

T06 · System Persistence

Warning
Location
SKILL.md:340
Finding

Residual Scheduled Task and Executable Upgrade Script

Content
View full analysis
> $log # 重启 gateway 任务 schtasks /run /tn "OpenClaw Gateway" >> $log 2>&1 "$(Get-Date -Format o) 完成" | Out-File $log -Append ``` ```powershell $st = (Get-Date).AddMinutes(2).ToString('HH:mm') schtasks /create /tn "OpenClaw Upgrade Once" ` /tr "powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\n3186\.openclaw\upgrade-once.ps1 -Version $target" ` /sc ONCE /st $st /f ``` ### Technical Analysis The Skill instructs the agent to write an executable PowerShell script and register a Windows scheduled task using `ExecutionPolicy Bypass`. The task is scheduled once, so its original purpose is consistent with completing an upgrade after the gateway process stops. However, the procedure does not delete either the task definition or the script after execution. A one-time task does not run periodically by itself, but it remains a cross-session execution artifact that can be manually invoked again. The retained task continues to reference a mutable script. Consequently, a user or process able to modify that script could cause different code to execute when the task is rerun. The `/f` option also overwrites an existing task with the same name without separately confirming ownership. ...[truncated 919 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:340
Finding

Hard-Coded Cross-User Script Path and Unsafe Scheduled-Task Command Construction

Content
View full analysis
> $log schtasks /run /tn "OpenClaw Gateway" >> $log 2>&1 "$(Get-Date -Format o) 完成" | Out-File $log -Append ``` ```powershell $st = (Get-Date).AddMinutes(2).ToString('HH:mm') schtasks /create /tn "OpenClaw Upgrade Once" ` /tr "powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\n3186\.openclaw\upgrade-once.ps1 -Version $target" ` /sc ONCE /st $st /f ``` ### Technical Analysis The scheduled-task command hard-codes `C:\Users\n3186` rather than resolving the profile of the account performing the upgrade. On another host or under another account, this path may belong to a different user, may not exist, or may contain a pre-existing file controlled by someone other than the operator. The `$target` value is embedded directly into the `/tr` command string. Earlier in the workflow it is obtained through `npm view openclaw version`, but the procedure does not require validating it against a strict version grammar before command construction. Quoting the complete task command as a single string leaves command-line parsing dependent on the value's contents. ### Attack Path **Cross-user path scenario:** 1. The workflow runs under an account other than `n3186`. 2. `C:\Users\n3186\.openclaw\upgrade- ...[truncated 1106 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:238
Finding

Global Installation from a Mutable and Unverified Package Source

Content
View full analysis
$null $target = npm view openclaw version Write-Host "当前: $cur" Write-Host "最新: $target" npm view "openclaw@$target" engines.node openclaw update status openclaw update --dry-run --tag $target ``` ```powershell # 安装目标版本（gateway 已停，无 DLL 锁定） npm install -g "openclaw@$Version" *>> $log # 重启 gateway 任务 schtasks /run /tn "OpenClaw Gateway" >> $log 2>&1 ``` The routing table and Windows notes also prescribe use of the `npmmirror` registry rather than requiring the official npm registry. ### Technical Analysis The target is selected using mutable registry metadata, and executable package content is then installed globally. The Windows procedure explicitly assumes a third-party npm mirror. The Skill does not require verification of the registry origin, package integrity digest, cryptographic signature, npm provenance, or an administrator-approved version allowlist. An npm installation may execute package lifecycle scripts and installs code that the gateway will subsequently load. A compromised mirror, registry account, DNS path, or package release can therefore change the effective code executed by the workflow after the Skill itself has been reviewed. ### Attack Path 1. An attacker compromises the configured npm registry, mirror, package publisher, or relevant network resolution path. 2. The registry advertises a malicious package version or returns altered package content. 3. The Skill obtains the version through `npm view`. 4. The workflow runs `npm install -g` without independent integrity or provenance verification. 5. Package lifecycle code may execute during installation. 6. The gateway is restarted and loads the installed malicious OpenClaw code. 7. The malicious package receives the ...[truncated 490 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:263
Finding

Plaintext Duplication and Indefinite Retention of Environment Secrets

Content
View full analysis
$null), '(\d+\.\d+\.\d+)')).Groups[1].Value Copy-Item "$env:USERPROFILE\.openclaw\openclaw.json" "$env:USERPROFILE\.openclaw\openclaw.json.bak-$cur" -Force Copy-Item "$env:USERPROFILE\.openclaw\.env" "$env:USERPROFILE\.openclaw\.env.bak-$cur" -Force Copy-Item "$env:USERPROFILE\.openclaw\gateway.cmd" "$env:USERPROFILE\.openclaw\gateway.cmd.bak-$cur" -Force # lossless-claw（npm 项目，只备份 package.json，node_modules 不备份） $ll = Get-ChildItem "$env:USERPROFILE\.openclaw\npm\projects" -Directory -ErrorAction SilentlyContinue | Where-Object { $_.Name -like '*lossless-claw*' } | Select-Object -First 1 if ($ll) { Copy-Item "$($ll.FullName)\package.json" "$($ll.FullName)\package.json.bak-$cur" -Force } Get-ChildItem "$env:USERPROFILE\.openclaw" -Filter "*.bak-$cur" | Select-Object Name ``` ```bash # [Linux] bash CURRENT_VER=$(openclaw --version 2>/dev/null | grep -oP '[\d.]+' | head -1) OVERRIDE="$HOME/.config/systemd/user/openclaw-gateway.service.d/override.conf" LOSSLESS_DIR="$HOME/.openclaw/extensions/lossless-claw" cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak-${CURRENT_VER} cp ~/.openclaw/.env ~/.openclaw/.env.bak-${CURRENT_VER} [ -f "$OVERRIDE" ] && cp "$OVERRIDE" "${OVERRIDE}.bak-${CURRENT_VER}" || echo "override.conf 不存在，跳过" ``` ### Technical Analysis The workflow copies `.env`, which commonly contains API keys, tokens, passwords, and service configuration, into predictably named plaintext backup files. It does not verify or enforce restrictive permissions on the destination, encrypt the backup, reject symbolic links or Windows reparse points, or define a retention and secure-deletion policy. On Linux, ordinary `cp` behavior is affected by the process um ...[truncated 1281 chars]
Remediation
View remediation

other

Note
Location
SKILL.md:151
Finding

Excessive Enumeration of Other User Profiles and Host Instances

Content
View full analysis
/dev/null); do if [ "$U" != "$(whoami)" ] && [ -d "/home/$U/.openclaw" ]; then echo "用户(同主机): $U"; SAME_HOST_USERS="$SAME_HOST_USERS $U" fi done # WSL 检测（bash 环境可能嵌套 WSL） if command -v powershell.exe &>/dev/null; then WSL_LIST=$(powershell.exe -NoProfile -Command "wsl --list --verbose" 2>/dev/null | grep -i -v "NAME\|Windows" || true) [ -n "$WSL_LIST" ] && echo "$WSL_LIST" && echo "⚠️ 检测到 WSL 实例，注意多实例共享 npm global 风险" fi echo "npm global path: $(npm root -g 2>/dev/null)" if [ -z "$SAME_HOST_USERS" ] && [ -z "$WSL_LIST" ]; then echo "未发现其他 OpenClaw 用户 ✅"; fi ``` ### Technical Analysis The Skill enumerates other Windows user profiles, Linux home directories, OpenClaw directories belonging to other accounts, and WSL instances. The declared purpose is to detect whether a global npm installation could affect multiple users, which is a legitimate concern. However, enumerating every profile and reporting usernames and instance details is broader than the minimum information needed to assess ownership and sharing of the actual npm global prefix. The shown commands do not bypass operating-system permissions and do not themselves read secret files. The primary concern is excessive collection and disclosure of host topology through command output and conver ...[truncated 877 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
- 2026-08-13（实测事故）：`openclaw update`（A 方案）在 Windows 上实测失败——它内部是「先装后停」（Linux 模式），撞 DLL 锁定；且停 gateway 时把自身（gateway 子进程）一起杀死，npm install 根本没执行，gateway 宕机 3.5 小时无人拉起。教训：Windows 主入口改为「分离式 schtasks 一次性任务」，`openclaw update` 在 Windows 上禁用。
- 2026-08-13：合并 Linux 原版 + Windows 适配版为「环境自适应版」。第零步升级为「环境探测 + 分类」（判定 OS 类型 + 服务托管方式），后续每步给出 `[Windows]`/`[Linux]` 双分支。Windows 分支保留 DLL 锁定 + 自杀陷阱两个硬坑（主入口 `openclaw update --tag`），Linux 分支保留原「先装后停」流程。原两个文件已归档到 `SKILL.linux-original.bak.md`（此版之前的 Windows 版内容见 git/历史）。
- 2026-08-13：Windows 适配。本机（SCRIPT-S03-04，Windows Server 2016）实测：gateway 由 Windows 任务计划程序（schtasks）托管而非 systemd；gateway 进程加载了 node-pty-win32-x64 / tree-sitter 等原生 .node DLL，Windows 锁定运行中 DLL → 运行时直接 `npm install -g openclaw` 会 EBUSY/EPERM 失败；agent 运行在 gateway 进程内部不能自己 stop 自己。故 Windows 主入口改为 `openclaw update --tag <版本>`，裸 npm install 降级为分离式 schtasks 任务兜底。同时适配：npm registry=npmmirror（无代理）、无 curl.exe（Server 2016）改用 Invoke-WebRequest、.env 无 GITHUB_TOKEN、lossless-claw 是 npm 项目路径、消息通道 POPO 无 feishu。
- 上次（4.14版本）因为没检查 lossless-claw 兼容性踩过坑
- 上次升级后忘记发完成通知，爸比等了7小时不知道结果
- 2026-07-27：NAS欢欢用自写脚本升级，脚本从gateway进程内部nohup启动，第一步systemctl stop把整个进程组一起杀掉，脚本自己被杀死，npm install根本没跑起来，gateway停了近6小时无人察觉——本skill的流程设计（npm install前不停服务、重启只在最后单独一步、重启前先设好通知cron）天然规避了这个坑，但重启这一步本身如果裸调systemctl也仍有被自身进程树波及的理论风险，已在第八步/回滚方案中改为优先走平台 gateway 工具

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 491)May include surrounding context.

md
- 2026-08-13（实测事故）：`openclaw update`（A 方案）在 Windows 上实测失败——它内部是「先装后停」（Linux 模式），撞 DLL 锁定；且停 gateway 时把自身（gateway 子进程）一起杀死，npm install 根本没执行，gateway 宕机 3.5 小时无人拉起。教训：Windows 主入口改为「分离式 schtasks 一次性任务」，`openclaw update` 在 Windows 上禁用。
- 2026-08-13：合并 Linux 原版 + Windows 适配版为「环境自适应版」。第零步升级为「环境探测 + 分类」（判定 OS 类型 + 服务托管方式），后续每步给出 `[Windows]`/`[Linux]` 双分支。Windows 分支保留 DLL 锁定 + 自杀陷阱两个硬坑（主入口 `openclaw update --tag`），Linux 分支保留原「先装后停」流程。原两个文件已归档到 `SKILL.linux-original.bak.md`（此版之前的 Windows 版内容见 git/历史）。
- 2026-08-13：Windows 适配。本机（SCRIPT-S03-04，Windows Server 2016）实测：gateway 由 Windows 任务计划程序（schtasks）托管而非 systemd；gateway 进程加载了 node-pty-win32-x64 / tree-sitter 等原生 .node DLL，Windows 锁定运行中 DLL → 运行时直接 `npm install -g openclaw` 会 EBUSY/EPERM 失败；agent 运行在 gateway 进程内部不能自己 stop 自己。故 Windows 主入口改为 `openclaw update --tag <版本>`，裸 npm install 降级为分离式 schtasks 任务兜底。同时适配：npm registry=npmmirror（无代理）、无 curl.exe（Server 2016）改用 Invoke-WebRequest、.env 无 GITHUB_TOKEN、lossless-claw 是 npm 项目路径、消息通道 POPO 无 feishu。
- 上次（4.14版本）因为没检查 lossless-claw 兼容性踩过坑
- 上次升级后忘记发完成通知，爸比等了7小时不知道结果
- 2026-07-27：NAS欢欢用自写脚本升级，脚本从gateway进程内部nohup启动，第一步systemctl stop把整个进程组一起杀掉，脚本自己被杀死，npm install根本没跑起来，gateway停了近6小时无人察觉——本skill的流程设计（npm install前不停服务、重启只在最后单独一步、重启前先设好通知cron）天然规避了这个坑，但重启这一步本身如果裸调systemctl也仍有被自身进程树波及的理论风险，已在第八步/回滚方案中改为优先走平台 gateway 工具

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Changing a temporary directory to mode 1777 is a powerful filesystem operation that can alter trust boundaries for any process using that path. In an automation skill, recommending such a broad permission change without validation can facilitate tampering or unsafe shared-directory usage.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
# /tmp/jiti 权限（codex EACCES 坑）
if [ -d "/tmp/jiti" ]; then
  JITI_PERM=$(stat -c "%a" /tmp/jiti)
  [ "$JITI_PERM" != "1777" ] && echo "⚠️ /tmp/jiti 权限 $JITI_PERM，建议 sudo chmod 1777 /tmp/jiti" || echo "/tmp/jiti: 1777 ✅"
else
  echo "/tmp/jiti: 不存在 ✅"
fi

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The workflow explicitly copies .env, which commonly contains secrets, into version-suffixed backup files. This proliferates credential-bearing material on disk, increases the number of secret copies that must be protected, and may leave readable backups in locations with broader retention, sync, or access than intended.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

md
# [Windows] PowerShell
$cur = ([regex]::Match((openclaw --version 2>$null), '(\d+\.\d+\.\d+)')).Groups[1].Value
Copy-Item "$env:USERPROFILE\.openclaw\openclaw.json" "$env:USERPROFILE\.openclaw\openclaw.json.bak-$cur" -Force
Copy-Item "$env:USERPROFILE\.openclaw\.env"            "$env:USERPROFILE\.openclaw\.env.bak-$cur" -Force
Copy-Item "$env:USERPROFILE\.openclaw\gateway.cmd"     "$env:USERPROFILE\.openclaw\gateway.cmd.bak-$cur" -Force
# lossless-claw（npm 项目，只备份 package.json，node_modules 不备份）
$ll = Get-ChildItem "$env:USERPROFILE\.openclaw\npm\projects" -Directory -ErrorAction SilentlyContinue |

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The Linux backup step duplicates ~/.openclaw/.env into a separate backup file, creating additional local copies of credentials or tokens. Secret duplication materially increases exposure through misconfigured permissions, backups, shell access by other users, or later accidental disclosure.

Content

Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.

md
LOSSLESS_DIR="$HOME/.openclaw/extensions/lossless-claw"

cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak-${CURRENT_VER}
cp ~/.openclaw/.env ~/.openclaw/.env.bak-${CURRENT_VER}
[ -f "$OVERRIDE" ] && cp "$OVERRIDE" "${OVERRIDE}.bak-${CURRENT_VER}" || echo "override.conf 不存在，跳过"
# lossless-claw：node_modules>500MB 时只备份 package.json/plugin.json/dist
if [ -d "$LOSSLESS_DIR" ]; then

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The Windows rollback path restores a .env backup, confirming that secret-bearing backup artifacts are part of the normal process. This entrenches a pattern of duplicating and reusing credentials from flat files, which broadens the attack surface and makes secret hygiene harder to enforce.

Content

Scanner excerpt · SKILL.md (reported line 454)May include surrounding context.

$prev = '<回退版本，如 2026.6.6>' npm install -g "openclaw@$prev" # gateway 需先停，参照第六步 A 兜底分离式任务 Copy-Item "$env:USERPROFILE.openclaw\openclaw.json.bak-$prev" "$env:USERPROFILE.openclaw\openclaw.json" -Force Copy-Item "$env:USERPROFILE.openclaw.env.bak-$prev" "$env:USERPROFILE.openclaw.env" -Force Copy-Item "$env:USERPROFILE.openclaw\gateway.cmd.bak-$prev" "$env:USERPROFILE.openclaw\gateway.cmd" -Force

优先 gateway 工具 action=restart，无工具才：schtasks /run /tn "OpenClaw Gateway"

text

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The Linux rollback step restores ~/.openclaw/.env from a backup file, again relying on duplicated credential material stored locally. In multi-user or backup-integrated systems, this raises the probability of unauthorized access to long-lived secrets.

Content

Scanner excerpt · SKILL.md (reported line 464)May include surrounding context.

md
PREV_VER=<回退版本>
npm install -g openclaw@${PREV_VER}
cp ~/.openclaw/openclaw.json.bak-${PREV_VER} ~/.openclaw/openclaw.json
cp ~/.openclaw/.env.bak-${PREV_VER} ~/.openclaw/.env
OVERRIDE="$HOME/.config/systemd/user/openclaw-gateway.service.d/override.conf"
[ -f "${OVERRIDE}.bak-${PREV_VER}" ] && cp "${OVERRIDE}.bak-${PREV_VER}" "$OVERRIDE"
LOSSLESS_BAK=$(ls -d "$HOME/.openclaw/extensions/lossless-claw.bak-"* 2>/dev/null | sort | tail -1)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

The rollback procedure includes rm -rf on a user-controlled path derived from filesystem state. Although the path is partially constrained, recursive deletion in automation is dangerous because mistakes, path manipulation, or unexpected variable values can lead to destructive data loss beyond the intended plugin directory.

Content

Scanner excerpt · SKILL.md (reported line 468)May include surrounding context.

OVERRIDE="$HOME/.config/systemd/user/openclaw-gateway.service.d/override.conf" [ -f "${OVERRIDE}.bak-${PREV_VER}" ] && cp "${OVERRIDE}.bak-${PREV_VER}" "$OVERRIDE" LOSSLESS_BAK=$(ls -d "$HOME/.openclaw/extensions/lossless-claw.bak-"* 2>/dev/null | sort | tail -1) [ -n "$LOSSLESS_BAK" ] && rm -rf "$HOME/.openclaw/extensions/lossless-claw" && cp -r "$LOSSLESS_BAK" "$HOME/.openclaw/extensions/lossless-claw" systemctl --user daemon-reload

优先 gateway 工具 action=restart，无工具才：systemctl --user restart openclaw-gateway.service

text

Chaining Abuse

High
Category
Tool Misuse
Confidence
86% confidence
Finding

The command chains a non-empty backup check with rm -rf and copy operations using &&, combining destructive deletion and restoration into a single line with little opportunity for validation or recovery. If the backup path or target path is wrong, the operator can lose the live plugin directory immediately and replace it with unintended content.

Content

Scanner excerpt · SKILL.md (reported line 468)May include surrounding context.

OVERRIDE="$HOME/.config/systemd/user/openclaw-gateway.service.d/override.conf" [ -f "${OVERRIDE}.bak-${PREV_VER}" ] && cp "${OVERRIDE}.bak-${PREV_VER}" "$OVERRIDE" LOSSLESS_BAK=$(ls -d "$HOME/.openclaw/extensions/lossless-claw.bak-"* 2>/dev/null | sort | tail -1) [ -n "$LOSSLESS_BAK" ] && rm -rf "$HOME/.openclaw/extensions/lossless-claw" && cp -r "$LOSSLESS_BAK" "$HOME/.openclaw/extensions/lossless-claw" systemctl --user daemon-reload

优先 gateway 工具 action=restart，无工具才：systemctl --user restart openclaw-gateway.service

text

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description says the skill must run whenever the user says phrases like "升级openclaw", "openclaw升级", or "更新openclaw". These are generic natural-language phrases rather than narrowly scoped commands, and the file does not provide exclusion conditions or negative examples to clarify when discussion of an upgrade should not invoke the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description and the entire skill content prescribe operation in Chinese, including required reporting to the user in that language, but there is no opt-in or alternative language path. This is a natural-language policy concern because it imposes a locale/language behavior for all uses without explicit user choice or a documented region-specific requirement.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
- 2026-08-13：Windows 适配。本机（SCRIPT-S03-04，Windows Server 2016）实测：gateway 由 Windows 任务计划程序（schtasks）托管而非 systemd；gateway 进程加载了 node-pty-win32-x64 / tree-sitter 等原生 .node DLL，Windows 锁定运行中 DLL → 运行时直接 `npm install -g openclaw` 会 EBUSY/EPERM 失败；agent 运行在 gateway 进程内部不能自己 stop 自己。故 Windows 主入口改为 `openclaw update --tag <版本>`，裸 npm install 降级为分离式 schtasks 任务兜底。同时适配：npm registry=npmmirror（无代理）、无 curl.exe（Server 2016）改用 Invoke-WebRequest、.env 无 GITHUB_TOKEN、lossless-claw 是 npm 项目路径、消息通道 POPO 无 feishu。
- 上次（4.14版本）因为没检查 lossless-claw 兼容性踩过坑
- 上次升级后忘记发完成通知，爸比等了7小时不知道结果
- 2026-07-27：NAS欢欢用自写脚本升级，脚本从gateway进程内部nohup启动，第一步systemctl stop把整个进程组一起杀掉，脚本自己被杀死，npm install根本没跑起来，gateway停了近6小时无人察觉——本skill的流程设计（npm install前不停服务、重启只在最后单独一步、重启前先设好通知cron）天然规避了这个坑，但重启这一步本身如果裸调systemctl也仍有被自身进程树波及的理论风险，已在第八步/回滚方案中改为优先走平台 gateway 工具
- 2026-07-27（同一事故的第二个坑）：NAS欢欢手动拉起gateway后agent恢复中断会话继续把npm包升到2026.7.1-2，但机器Node还是22.22.1，openclaw 2026.7.1-2要求Node≥22.22.3，gateway直接拒绝启动；且该NAS访问registry.npmjs.org走IPv6比IPv4慢6倍，codex插件依赖安装卡在慢速IPv6上4分半——第零步此前没查Node版本、没做IPv4/IPv6测速，两个真实缺口已补入
- 2026-07-27（第三个坑，元问题）：description字段被写成changelog摘要，覆盖了触发关键词，导致agent在用户说"升级openclaw"时语义匹配不上这个skill。教训：description只写"什么场景触发"，绝不写"这次改了什么"；changelog一律写在本节。

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
- 2026-08-13:Windows 适配。本机(SCRIPT-S03-04,Windows Server 2016)实测:gateway 由 Windows 任务计划程序(schtasks)托管而非 systemd;gateway 进程加载了 node-pty-win32-x64 / tree-sitter 等原生 .node DLL,Windows 锁定运行中 DLL → 运行时直接 `npm install -g openclaw` 会 EBUSY/EPERM 失败;agent 运行在 gateway 进程内部不能自己 stop 自己。故 Windows 主入口改为 `openclaw update --tag <版本>`,裸 npm install 降级为分离式 schtasks 任务兜底。同时适配:npm registry=npmmirror(无代理)、无 curl.exe(Server 2016)改用 Invoke-WebRequest、.env 无 GITHUB_TOKEN、lossless-claw 是 npm 项目路径、消息通道 POPO 无 feishu。
- 上次(4.14版本)因为没检查 lossless-claw 兼容性踩过坑
- 上次升级后忘记发完成通知,爸比等了7小时不知道结果
- 2026-07-27:NAS欢欢用自写脚本升级,脚本从gateway进程内部nohup启动,第一步systemctl stop把整个进程组一起杀掉,脚本自己被杀死,npm install根本没跑起来,gateway停了近6小时无人察觉——本skill的流程设计(npm install前不停服务、重启只在最后单独一步、重启前先设好通知cron)天然规避了这个坑,但重启这一步本身如果裸调systemctl也仍有被自身进程树波及的理论风险,已在第八步/回滚方案中改为优先走平台 gateway 工具
- 2026-07-27(同一事故的第二个坑):NAS欢欢手动拉起gateway后agent恢复中断会话继续把npm包升到2026.7.1-2,但机器Node还是22.22.1,openclaw 2026.7.1-2要求Node≥22.22.3,gateway直接拒绝启动;且该NAS访问registry.npmjs.org走IPv6比IPv4慢6倍,codex插件依赖安装卡在慢速IPv6上4分半——第零步此前没查Node版本、没做IPv4/IPv6测速,两个真实缺口已补入
- 2026-07-27(第三个坑,元问题):description字段被写成changelog摘要,覆盖了触发关键词,导致agent在用户说"升级openclaw"时语义匹配不上这个skill。教训:description只写"什么场景触发",绝不写"这次改了什么";changelog一律写在本节。

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
echo "⚠️ 仅确认当前 Node 不够，必须第一步拿到目标版本 engines.node 后对比。"

# 代理检测
if curl -s --connect-timeout 3 -x "http://127.0.0.1:7890" https://registry.npmjs.org/ > /dev/null 2>&1; then
  PROXY_OPT="--proxy http://127.0.0.1:7890"; echo "代理: 127.0.0.1:7890 ✅"
elif curl -s --connect-timeout 3 https://registry.npmjs.org/ > /dev/null 2>&1; then
  PROXY_OPT=""; echo "代理: 直连 ✅"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
72% confidence
Finding

Recommending chmod 1777 on /tmp/jiti creates a world-writable sticky directory, which can introduce tampering or symlink/hijack risks if the path is later trusted by privileged or security-sensitive processes. In a maintenance skill, such blanket permission changes normalize unsafe filesystem practices and may weaken host integrity.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
# /tmp/jiti 权限（codex EACCES 坑）
if [ -d "/tmp/jiti" ]; then
  JITI_PERM=$(stat -c "%a" /tmp/jiti)
  [ "$JITI_PERM" != "1777" ] && echo "⚠️ /tmp/jiti 权限 $JITI_PERM，建议 sudo chmod 1777 /tmp/jiti" || echo "/tmp/jiti: 1777 ✅"
else
  echo "/tmp/jiti: 不存在 ✅"
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Recommending chmod 1777 on /tmp/jiti creates a world-writable sticky directory, which can introduce tampering or symlink/hijack risks if the path is later trusted by privileged or security-sensitive processes. In a maintenance skill, such blanket permission changes normalize unsafe filesystem practices and may weaken host integrity.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
# /tmp/jiti 权限（codex EACCES 坑）
if [ -d "/tmp/jiti" ]; then
  JITI_PERM=$(stat -c "%a" /tmp/jiti)
  [ "$JITI_PERM" != "1777" ] && echo "⚠️ /tmp/jiti 权限 $JITI_PERM，建议 sudo chmod 1777 /tmp/jiti" || echo "/tmp/jiti: 1777 ✅"
else
  echo "/tmp/jiti: 不存在 ✅"
fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
77% confidence
Finding

The skill instructs sending an Authorization header with $GITHUB_TOKEN to api.github.com. Even though this is a legitimate API call, embedding token-bearing outbound requests in a broadly triggered skill increases the chance of unnecessary credential use, accidental disclosure in logs, or use in environments where such access should be avoided.

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

npm view openclaw@${TARGET_VER} engines.node

发行说明（有 GITHUB_TOKEN 时）：

curl -s -H "Authorization: token $GITHUB_TOKEN"
"https://api.github.com/repos/openclaw/openclaw/releases/tags/v${TARGET_VER}" |
python3 -c "import json,sys; print(json.load(sys.stdin).get('body','')[:3000])"

text