ClawHub
Back to skill

Security audit

OpenClaw Upgrade

Security checks across malware telemetry and agentic risk

Overview

The skill is a real OpenClaw upgrade workflow, but it handles local secrets and persistent notifications in ways users should review before installing.

Review this skill before installing. It is not evidence of malware, but it gives an agent authority to upgrade global OpenClaw, inspect other local OpenClaw users/WSL installs, read ~/.openclaw/.env, create versioned plaintext .env backups, schedule a one-time cron notification, and restart the gateway. Consider removing the GitHub token lookup, tightening cross-user discovery, and adding cleanup or safer handling for secret backups.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill scans /home for other users, inspects their ~/.openclaw directories, and attempts WSL instance enumeration via powershell.exe. That exceeds the minimum data access needed for a local package upgrade and exposes unrelated user/account presence and installation metadata, creating unnecessary privacy and host-reconnaissance risk.

Context-Inappropriate Capability

Medium
Confidence
83% confidence
Finding
The forced creation of a cron/systemEvent job to notify a user after restart introduces an unnecessary persistence and messaging action unrelated to the core mechanics of upgrading software. It expands the skill's authority by scheduling deferred actions and sending messages outside the immediate session, which can be abused or create unintended side effects.

Credential Access

High
Category
Privilege Escalation
Content
openclaw --version
npm view openclaw version

GITHUB_TOKEN=*** GITHUB_TOKEN ~/.openclaw/.env | cut -d= -f2)
TARGET_VER=<目标版本，如 2026.5.12>
curl -s -H "Authorization: token $GITHUB_TOKEN" \
  "https://api.github.com/repos/openclaw/openclaw/releases/tags/v${TARGET_VER}" | \
Confidence
98% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
echo "2/5 override.conf 不存在，跳过 ✅"
fi

cp ~/.openclaw/.env ~/.openclaw/.env.bak-${CURRENT_VER}
echo "3/5 .env ✅"

if [ -d "$LOSSLESS_DIR" ]; then
Confidence
93% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
fi

cp ~/.openclaw/.env ~/.openclaw/.env.bak-${CURRENT_VER}
echo "3/5 .env ✅"

if [ -d "$LOSSLESS_DIR" ]; then
  LOSSLESS_VER=$(cat "$LOSSLESS_DIR/package.json" | \
Confidence
92% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
npm install -g openclaw@${PREV_VER}

cp ~/.openclaw/openclaw.json.bak-${PREV_VER} ~/.openclaw/openclaw.json
cp ~/.openclaw/.env.bak-${PREV_VER} ~/.openclaw/.env

if [ -f "${OVERRIDE}.bak-${PREV_VER}" ]; then
  cp "${OVERRIDE}.bak-${PREV_VER}" "$OVERRIDE"
Confidence
91% confidence
Finding
.env

Tool Parameter Abuse

High
Category
Tool Misuse
Content
fi

if [ -n "$LOSSLESS_BAK" ] && [ -d "$LOSSLESS_BAK" ]; then
  rm -rf "$HOME/.openclaw/extensions/lossless-claw"
  cp -r "$LOSSLESS_BAK" "$HOME/.openclaw/extensions/lossless-claw"
  echo "lossless-claw 已还原 ✅"
else
Confidence
94% confidence
Finding
rm -rf "$HOME/.openclaw/extensions/

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
SKILL.md:428