openclaw-cheatsheet

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:15 PM UTC
• Version: 1.0.0

Overview

This is mostly a CLI reference, but it includes unrelated copy-paste commands that can change external accounts or run unreviewed local code.

Review this skill before installing or using it as an agent reference. Treat its examples as documentation, not safe defaults: replace the hardcoded calendar account, confirm all targets and vault paths, avoid destructive commands without backups, and do not run the Discussion Runner live command unless you have independently verified that local script and its permissions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:20
• Finding: Hardcoded Personal Calendar Account in a State-Changing Command<![CDATA[ ## Vulnerability Details **File Location**: `README.md:20` **Vulnerability Type**: Hardcoded external account in an unrelated state-changing example **Risk Level**: Medium ### Vulnerable Code ```bash gog calendar create [e-mail] --summary "퀵 호출" --from "2026-02-20T09:00:00+09:00" --to "2026-02-20T09:15:00+09:00" ``` ### Technical Analysis The package identifies itself as an OpenClaw CLI cheatsheet, but this example invokes the separate `gog` utility to create a calendar event for the hardcoded account `[e-mail]`. Calendar creation is outside the declared OpenClaw reference scope and is a state-changing operation. The command does not contain a confirmation warning, despite the package's stated policy of obtaining confirmation before operational changes. If a user has an authenticated `gog` environment with permission to access the specified calendar, copying the example can modify that calendar immediately. The hardcoded address is not established to be a secret. The security concern is the unsafe use of a fixed personal account as the target of a copy-paste-ready, state-changing command. ### Attack Path 1. A user trusts the README as a source of safe, copy-paste-ready examples. 2. The user has `gog` installed and authenticated with calendar access. 3. The user copies and executes the documented command without replacing the hardcoded account. 4. `gog` submits a calendar creation request using the user's existing credentials. 5. An event is created in, or associated with, the unintended hardcoded account. ### Impact Assessment The command runs with the permissions of the current user's authenticated `gog` session. It does not independently escalate privileges. Its scope is limited to calendar resources that the user is already authorized to modify. Successful execution can cause unauthorized or unintended calendar modification and disclose the event title and scheduling metadata to the hardcoded account or its calendar participan ...[truncated 9 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the unrelated `gog` example from this OpenClaw CLI package. 2. If calendar integration is intentionally supported, document it as a separate, declared capability. 3. Replace the personal address with a neutral placeholder such as `[e-mail]` or `<calendar-account>`. 4. Add an explicit warning that the command creates a real calendar event. 5. Recommend a preview or dry-run mode when supported. 6. Require the user to verify the target account, event content, start time, and end time before execution. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/openclaw-cheatsheet.md:150
• Finding: Execution of an Unbundled and Unverified External Local Script<![CDATA[ ## Vulnerability Details **File Location**: `references/openclaw-cheatsheet.md:150-160` **Vulnerability Type**: Execution of mutable code outside the audited package **Risk Level**: Medium ### Vulnerable Code ```bash ## Discussion Runner # dryrun (더미 응답, CLI 호출 안 함) node ~/.openclaw/workspace-shared/scripts/discussion/discussion_runner.js \ --topic "주제" --mode dryrun --rounds 3 # 실제 실행 node ~/.openclaw/workspace-shared/scripts/discussion/discussion_runner.js \ --topic "주제" --mode live --rounds 3 ``` The security-sensitive live invocation is: ```bash node ~/.openclaw/workspace-shared/scripts/discussion/discussion_runner.js \ --topic "주제" --mode live --rounds 3 ``` ### Technical Analysis The cheatsheet instructs users to execute `discussion_runner.js`, but that script is not present in the audited project. Consequently, its source, provenance, integrity, dependencies, and runtime behavior cannot be verified from this package. The command references a mutable path in the user's home directory rather than a bundled or version-pinned artifact. Any process or user able to modify that file can alter what the documented command executes. The `live` mode also indicates operational behavior rather than a harmless preview, but the documentation does not request confirmation or explain the script's permissions and external effects. This is not confirmed remote payload retrieval because the documented command does not download code from a URL. The risk arises from delegating execution to unreviewed local code outside the package. ### Attack Path 1. The external `discussion_runner.js` file is created or modified by another package, compromised process, local attacker, or unsafe workspace synchronization. 2. A user follows the cheatsheet and executes the documented Node.js command in `live` mode. 3. Node.js loads the current contents of the external script without an integrity check. 4. The script executes with the user's operating-system permissi ...[truncated 830 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the external script execution instructions unless the Discussion Runner is an explicitly declared package capability. 2. Bundle the script in the audited package if it is required, and include its complete source and dependencies for review. 3. Pin the script to a trusted version and verify its cryptographic checksum or signature before execution. 4. Document the script's expected file, network, credential, messaging, and agent access. 5. Require explicit user confirmation before invoking `--mode live`. 6. Prefer dry-run operation by default and show the planned actions before live execution. 7. Resolve and validate the script path, reject symbolic-link substitutions where practical, and ensure the file is owned by a trusted user and not writable by untrusted principals. 8. Execute the script with the minimum necessary environment variables and filesystem permissions. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The package description claims the file is a reference for OpenClaw CLI commands, but the document contains an unrelated external calendar command, creating a trust-boundary violation between declared scope and actual content. Because this is a reference skill meant to be consulted for command usage, users may reasonably assume every included example is safe and relevant, increasing the chance of accidental execution of non-OpenClaw actions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as an OpenClaw CLI cheatsheet, but it includes a copy-pasteable command for a different tool (`gog`) that performs a real external action. In an agent skill context, unrelated operational commands can mislead users or downstream agents into executing the wrong tool, causing unintended side effects such as creating calendar events or exposing account-specific data.

Session Persistence

Medium

• Category: Rogue Agent

Content

openclaw message send --channel discord --target <channel_id> --message "내용"

# 스레드 생성
openclaw message thread create --channel discord --target <channel_id> \
  --thread-name "스레드명" --message "첫 메시지" --json

# 스레드 답장

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The cheatsheet includes destructive commands such as config unset and agents delete without any warning, confirmation guidance, backup advice, or safer alternatives. In an agent skill intended for operational use, this can lead users or downstream agents to perform irreversible configuration loss or agent deletion from terse copy-paste examples.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest says this skill is a quick reference for OpenClaw CLI commands, sub-commands, and flags. However, the document also provides operational guidance for `obsidian-cli`, environment variables, and a standalone Node-based discussion runner, which expands the skill from OpenClaw CLI reference into unrelated tooling and runtime workflow documentation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The Obsidian examples include overwrite and delete operations without warning about data loss or the need to verify vault and path targets. In a quick-reference document, such terse examples increase the chance of accidental destructive actions, especially when used by automation or copied without careful review.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The stated purpose promises a comprehensive reference for every OpenClaw CLI command, sub-command, and flag. The file contains examples for some command groups, but not exhaustive command/flag coverage, and even uses `daemon` where the manifest describes `gateway`, creating a mismatch between claimed completeness and actual content.

Static analysis

No suspicious patterns detected.