T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:673- Finding
Mandatory Cross-Skill Enforcement Hijacks Agent and Skill Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Credential Manager
Security checks for vulnerabilities and agentic risk
Overview
This skill has a legitimate credential-management purpose, but it asks for broad control over sensitive local credentials and includes unsafe guidance and scripts that could expose or damage them.
Review carefully before installing. Do not use this as a mandatory cross-skill policy without explicit opt-in, do not store the GPG passphrase in the same .env, do not source generated .env files as shell code unless values are safely serialized, and avoid running cleanup or setup-gpg.sh until you have verified backups and understand the global GPG changes.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:614- Finding
Shell Command Injection Through GPG Passphrase in Recommended Node.js Loader
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/consolidate.py:121- Finding
Unescaped Credential Values Are Written to a File Later Executed as Shell Code
- Content
View full analysis
Dict: """Load credentials from a file.""" if path.suffix == '.json': with open(path) as f: data = json.load(f) # Flatten nested dicts for .env compatibility flat = {} for k, v in data.items() if isinstance(data, dict) else []: if isinstance(v, (dict, list)): flat[k] = json.dumps(v, separators=(',', ':')) else: flat[k] = str(v) return flat if flat else (data if isinstance(data, dict) else {}) elif '.env' in path.name: creds = {} with open(path) as f: for line in f: line = line.strip() if '=' in line and not line.startswith('#'): key, val = line.split('=', 1) creds[key.strip()] = val.strip() return creds return {} ``` ```python with open(env_file, 'w') as f: f.write("# OpenClaw Agent Credentials\n") f.write("# Generated by credential-manager skill\n\n") # Group by service services = {} for key, value in sorted(env_data.items()): service = key.split('_')[0] if '_' in key else 'OTHER' if service not in services: services[service] = [] services[service].append((key, value)) for service, items in sorted(services.items()): f.write(f"# {service}\n") for key, value in items: f.write(f"{key}={value}\n") f.write("\n") ``` The generated file is subsequently recommended for execution in `SKILL.md:730-738`: ```bash # Load .env set -a source ~/.openclaw/.env set +a ``` ### Technical Analysis Credential keys and values loaded from discovered JSON or `.env` files are written dir ...[truncated 1652 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/encrypt.py:50- Finding
Decryption Failure Can Silently Overwrite Existing Encrypted Secrets
- Content
View full analysis
dict: """Decrypt and load existing secrets from GPG file.""" if not secrets_file.exists(): return {} if passphrase is None: passphrase = _get_passphrase() try: result = subprocess.run( ['gpg', '-d', '--batch', '--quiet', '--passphrase-fd', '0', str(secrets_file)], input=passphrase, capture_output=True, text=True, timeout=30 ) if result.returncode == 0: return json.loads(result.stdout) else: print(f"❌ GPG decryption failed: {result.stderr.strip()}", file=sys.stderr) except (subprocess.TimeoutExpired, json.JSONDecodeError) as e: print(f"❌ Failed to load secrets: {e}", file=sys.stderr) return {} ``` ```python # Load existing secrets secrets = load_secrets(secrets_file, passphrase) encrypted = [] not_found = [] for key in key_names: key = key.strip() if key not in env_data: not_found.append(key) continue value = env_data[key] # Skip if already encrypted if value.startswith('GPG:'): print(f" ⏭️ {key}: already encrypted") continue # Move value to secrets secrets[key] = value encrypted.append(key) ... # Save encrypted secrets print(f"\n🔐 Encrypting {len(encrypted)} key(s)...") if not save_secrets(secrets_file, secrets, passphrase): return False ``` `save_secrets()` invokes GPG with `--yes` and writes to the existing destination. ### Technical Analysis When an encrypted secrets file exists but cannot be decrypted—because of a wrong passphrase, corruption, timeout, or invalid JSON—`load_secrets()` logs an error and returns an em ...[truncated 1331 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/setup-gpg.sh:59- Finding
Skill-Specific Setup Overwrites Global GPG Security Configuration
- Content
View full analysis
"$AGENT_CONF" << EOF # OpenClaw GPG Agent Configuration # Cache passphrase for ${CACHE_HOURS} hours default-cache-ttl ${CACHE_SECONDS} max-cache-ttl ${CACHE_SECONDS} # Allow loopback pinentry (for headless/script usage) allow-loopback-pinentry EOF chmod 600 "$AGENT_CONF" # Configure GPG to use loopback pinentry GPG_CONF="$GPG_DIR/gpg.conf" if ! grep -q "pinentry-mode loopback" "$GPG_CONF" 2>/dev/null; then echo "pinentry-mode loopback" >> "$GPG_CONF" fi echo " ✅ Agent configured (cache: ${CACHE_HOURS}h)" # Reload agent gpgconf --kill gpg-agent 2>/dev/null || true ``` ### Technical Analysis The setup script modifies the user's global `~/.gnupg` configuration rather than creating a Skill-specific GPG home. It completely replaces `gpg-agent.conf`, enables loopback pinentry, sets an eight-hour cache by default, appends a global pinentry policy, and kills the shared GPG agent. These changes affect all GPG keys and clients owned by the user, including unrelated signing, encryption, and authentication workflows. Existing hardening directives in `gpg-agent.conf` are removed from the active configuration. The backup limits recoverability but does not preserve or merge existing policy. The broad change is unnecessary for encrypting one Skill-specific secrets file and exceeds least-privilege configuration scope. ### Attack Path 1. The user follows the documented first-time setup procedure. 2. The script copies the previous agent configuration to a backup a ...[truncated 687 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (231)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
Mandating that all credentials live in '~/.openclaw/.env' creates a single high-value target in a predictable location. If any skill, script, backup process, or local compromise gains read access to that file, all consolidated credentials may be exposed at once.
- Content
There is exactly ONE location for all OpenClaw credentials:
text ~/.openclaw/.envNo exceptions. Not workspace, not skills, not scripts. Root only.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The rule explicitly instructs scanning and consolidating files such as '~/.config/*/credentials.json' into a single .env file. Broadly harvesting credential files across unrelated tools or services can pull in secrets beyond OpenClaw's scope, increase unnecessary access to sensitive material, and weaken separation between applications.
- Content
md - `~/.openclaw/workspace/skills/*/.env` ❌ → Root - `~/.openclaw/workspace/skills/*/repo/.env` ❌ → Root - `~/.openclaw/workspace/scripts/.env` ❌ → Root - `~/.config/*/credentials.json` ❌ → Root - Any scattered API key files ❌ → Root ## Enforcement
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The enforcement section describes detecting all credential files, merging them into one location, and removing originals. This operational pattern can over-collect secrets, erase separation of duties, and turn one file compromise into full credential compromise, especially because the skill frames consolidation as mandatory.
- Content
md The credential-manager skill enforces this rule: 1. **Scan:** Detects ALL .env files and credential files 2. **Consolidate:** Merges everything into `~/.openclaw/.env` 3. **Cleanup:** Removes scattered files (after backup) 4. **Validate:** Ensures no scattered files remain
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The guidance tells all skill developers to load credentials from a shared root secret file. This encourages broad credential exposure across skills, including skills that may only need a subset of secrets, and increases the chance that a compromised or buggy skill can read unrelated credentials.
- Content
md ## For Skill Developers **DO NOT create .env files in your skill directories.** Load credentials from root:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The shell example explicitly uses 'source ~/.openclaw/.env', which executes the contents of that file in the current shell. If the .env contains shell metacharacters, command substitutions, or malicious content, sourcing it can execute arbitrary commands in addition to exposing all loaded secrets to the process environment.
- Content
bash #!/bin/bash # Load from root .env source ~/.openclaw/.env # Use credentials
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The Python example directs developers to read a shared root .env file, reinforcing centralized plaintext secret access from any skill code. While less dangerous than shell sourcing, it still promotes broad, predictable access to all credentials from code that may not need them.
- Content
python #!/usr/bin/env python3 # Load from root .env from pathlib import Path env_file = Path.home() / '.openclaw' / '.env' # ... load and use
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill markets itself as a mandatory security foundation with encryption, rotation tracking, deep scanning, permission enforcement, and migration support, but the analysis indicates those controls are missing, partial, or delegated elsewhere. This kind of security overclaim can cause operators to trust the skill, store secrets under false assumptions, and skip compensating controls.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill markets itself as a mandatory security foundation with encryption, rotation tracking, deep scanning, permission enforcement, and migration support, but the analysis indicates those controls are missing, partial, or delegated elsewhere. This kind of security overclaim can cause operators to trust the skill, store secrets under false assumptions, and skip compensating controls.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill markets itself as a mandatory security foundation with encryption, rotation tracking, deep scanning, permission enforcement, and migration support, but the analysis indicates those controls are missing, partial, or delegated elsewhere. This kind of security overclaim can cause operators to trust the skill, store secrets under false assumptions, and skip compensating controls.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill markets itself as a mandatory security foundation with encryption, rotation tracking, deep scanning, permission enforcement, and migration support, but the analysis indicates those controls are missing, partial, or delegated elsewhere. This kind of security overclaim can cause operators to trust the skill, store secrets under false assumptions, and skip compensating controls.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill markets itself as a mandatory security foundation with encryption, rotation tracking, deep scanning, permission enforcement, and migration support, but the analysis indicates those controls are missing, partial, or delegated elsewhere. This kind of security overclaim can cause operators to trust the skill, store secrets under false assumptions, and skip compensating controls.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill markets itself as a mandatory security foundation with encryption, rotation tracking, deep scanning, permission enforcement, and migration support, but the analysis indicates those controls are missing, partial, or delegated elsewhere. This kind of security overclaim can cause operators to trust the skill, store secrets under false assumptions, and skip compensating controls.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill markets itself as a mandatory security foundation with encryption, rotation tracking, deep scanning, permission enforcement, and migration support, but the analysis indicates those controls are missing, partial, or delegated elsewhere. This kind of security overclaim can cause operators to trust the skill, store secrets under false assumptions, and skip compensating controls.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill markets itself as a mandatory security foundation with encryption, rotation tracking, deep scanning, permission enforcement, and migration support, but the analysis indicates those controls are missing, partial, or delegated elsewhere. This kind of security overclaim can cause operators to trust the skill, store secrets under false assumptions, and skip compensating controls.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - `~/.local/share/*/credentials.json` — Local share directories **Sensitive Key Patterns:** - API keys, access tokens, bearer tokens - Secrets, passwords, passphrases - OAuth consumer keys - Private keys, signing keys, wallet keys
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation says high-value secrets should never exist as plaintext on disk, then later recommends storing the GPG passphrase in the same plaintext .env file. That collapses the protection boundary: anyone who can read the .env can also decrypt the supposedly protected secrets.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions explicitly tell users to store the GPG passphrase in the main .env without warning that this defeats much of the benefit of encrypting high-value secrets. Users following the guide would create a single compromise point for both encrypted data and the decryption key.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Recommending the central credential file as storage for the GPG passphrase creates a natural-language secret exfiltration path in the very file meant to centralize credentials. A compromise of that file yields both application credentials and the means to decrypt protected private keys, magnifying blast radius.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The documentation includes a direct rm of a credential file after migration. In a skill that already overclaims safety and supports auto-confirm flows, destructive cleanup can cause accidental loss of the only usable credential copy or delete the wrong file if migration/backup validation is incomplete.
- Content
Example: farcaster-credentials.json was manually migrated
cp ~/.openclaw/farcaster-credentials.json ~/.openclaw/backups/credentials-old-YYYYMMDD/farcaster-credentials.json.bak chmod 600 ~/.openclaw/backups/credentials-old-YYYYMMDD/farcaster-credentials.json.bak rm ~/.openclaw/farcaster-credentials.json
text ### Step 7: Update Scripts That Referenced Old Files
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The 'secure' Bash and Node examples interpolate or pipe the passphrase into shell commands, exposing it to process arguments, shell history, logs, crash dumps, or child-process capture. This undermines the claimed GPG protection and creates additional plaintext exposure paths for the most sensitive secret.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Use Separate Credentials
bash # Development ~/.openclaw/.env.development # Production ~/.openclaw/.env.production
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
~/.openclaw/.env.development
Production
~/.openclaw/.env.production
Never mix environments
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The documentation recommends decrypting secrets into
/tmp/.env, which is a globally predictable temporary path and may be exposed to other local processes or users depending on system configuration. It also increases the chance of leaving plaintext secrets behind on disk after use.- Content
For Extra Security
bash # Encrypt .env with GPG gpg -c ~/.openclaw/.env # Decrypt when needed gpg -d ~/.openclaw/.env.gpg > /tmp/.env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
This line is part of the same decryption example that writes plaintext credentials to
/tmp/.env. Storing decrypted secrets in a temporary shared location creates avoidable local exposure and persistence risk.- Content
gpg -c ~/.openclaw/.env
Decrypt when needed
gpg -d ~/.openclaw/.env.gpg > /tmp/.env
text ### Use Secret Managers
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 74% confidence
- Finding
The incident-response example uses
sed -i 's/old_key/new_key/' ~/.openclaw/.env, which can place secret values directly in shell history, process arguments, and potentially logs or monitoring tools. That undermines the surrounding guidance about avoiding secret exposure in command lines and terminals.- Content
bash # 1. Revoke old key in service dashboard # 2. Generate new key # 3. Update .env sed -i 's/old_key/new_key/' ~/.openclaw/.env # 4. Test ./test_credentials.sh
Static analysis
No suspicious patterns detected.