Openclaw Starter

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:53 AM UTC
• Version: 1.0.2

Overview

This is mostly a local OpenClaw onboarding guide, but it pushes beginners toward bulk installing unverified high-capability skills and an unpinned dependency.

Review this skill before installing. Use the guide as documentation, but avoid running bulk install commands blindly; install recommended skills one at a time after checking publisher, permissions, and whether you really need high-impact abilities like SSH, code execution, cron jobs, webhooks, or email sending. Keep bot tokens out of chats, screenshots, and repositories, and consider removing or pinning the unused requests dependency.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:4

Finding

Unpinned and Unused Third-Party Dependency Creates Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:4
Related Locations: README.md:22-24, README.md:70-82, SKILL.md:162-183, scripts/guide.py:91-96, scripts/quickstart.py:251-254
Vulnerability Type: Unpinned and unnecessary third-party dependency
Risk Level: Medium

Vulnerable Code

text

requests>=2.28.0

The documentation also recommends bulk installation of externally maintained Skills:

bash

clawhub install game-deals weather rss-aggregator password-generator unit-converter
clawhub install git-essentials json-formatter ocr-local pdf-toolkit-pro
clawhub install cron-manager reminder-skill webhook-handler email-sender

Technical Analysis

The dependency specification accepts any requests release from version 2.28.0 onward without an exact version, integrity hash, or lock file. Neither Python script imports requests, making this dependency unnecessary for the currently implemented local guidance and environment-checking functionality.

Installing an unnecessary and unpinned package expands the supply-chain attack surface. If the package source, a future release, a transitive dependency, or the configured package index is compromised, package installation may execute attacker-controlled build or installation logic. The risk is increased when users run the documented unrestricted command:

bash

pip3 install -r requirements.txt

The project also recommends installing multiple external Skills in bulk without version constraints, integrity verification, publisher validation, or individual capability review. Some recommendations concern high-impact functionality, including SSH management, arbitrary code execution, scheduled tasks, webhooks, and email sending. Although these capabilities are not implemented by this project itself, installing them without review can substantially expand the OpenClaw agent's privileges and attack surface.

Attack Path

...[truncated 1413 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove requests because it is not imported or required by either Python script.
2. If online checking is implemented later, pin an exact reviewed version rather than using a lower-bound constraint.
3. Generate a lock file and require cryptographic hashes, for example through pip-compile --generate-hashes and pip install --require-hashes.
4. Review and pin all transitive dependencies before release.
5. Use a trusted package index and prevent fallback to untrusted or user-controlled indexes.
6. Replace bulk Skill installation commands with individual, version-pinned installation examples.
7. Document each recommended Skill's publisher, source repository, required permissions, and integrity information.
8. Require explicit user review and consent before recommending high-capability Skills involving SSH, code execution, scheduled tasks, webhooks, or outbound communications.
9. Run third-party Skills with least privilege and isolate them from sensitive configuration, credentials, and unrelated workspace files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and instructs shell-capable operations such as running python3 scripts, clawhub install, and openclaw commands, but it does not declare any explicit tool scope or permissions. In an agent ecosystem, this can cause the host to grant or infer broader execution capability than users expect, increasing the chance of unintended command execution or abuse through prompt-triggered invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrases are broad, common onboarding expressions like '新手入门' and '从哪里开始' without exclusions or tighter context checks. This can cause the skill to activate in unrelated conversations and steer the agent toward recommending installs or configuration steps, creating confused-deputy behavior and increasing the likelihood of unnecessary shell actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The document is primarily written for Chinese-language use, but the provided SOUL.md template is entirely in English and the USER.md template hardcodes the timezone example to Asia/Shanghai. This presents a language/locale preference without an explicit opt-in or user choice, which can violate organizational language/locale policy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide tells users to reset, copy, and enter a Discord Bot Token, but does not warn that the token is a sensitive secret equivalent to credentials for the bot. In a setup guide for a messaging integration, omission of basic secret-handling guidance increases the chance users will paste tokens into insecure places, commit them to files, or expose them in screenshots or chat logs, enabling account takeover of the bot.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide asks users to input a Telegram bot token into the OpenClaw configuration flow but does not clearly warn that the token is a sensitive secret granting control over the bot via the Telegram Bot API. In onboarding documentation for beginners, omission of explicit handling guidance increases the chance that users paste the token into insecure places, share screenshots, or commit configuration files containing the token.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python skill’s user-facing description and all interaction text are written exclusively in Chinese, indicating a fixed language/locale experience. The file does not offer any language selection, opt-in, or explanation that the tool is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/quickstart.py (reported line 53)May include surrounding context.

python

# Node.js 检测
    try:
        result = subprocess.run(['node', '--version'], capture_output=True, text=True, timeout=5)
        node_version = result.stdout.strip()
        if node_version:
            print_success(f"Node.js: {node_version}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/quickstart.py (reported line 70)May include surrounding context.

python

# npm 检测
    try:
        result = subprocess.run(['npm', '--version'], capture_output=True, text=True, timeout=5)
        npm_version = result.stdout.strip()
        if npm_version:
            print_success(f"npm: {npm_version}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/quickstart.py (reported line 126)May include surrounding context.

python

# OpenClaw CLI 检测
    try:
        result = subprocess.run(['openclaw', '--version'], capture_output=True, text=True, timeout=5)
        if result.returncode == 0:
            version = result.stdout.strip()
            print_success(f"OpenClaw CLI: 已安装 ({version})")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/quickstart.py (reported line 144)May include surrounding context.

python

# Gateway 状态
    try:
        result = subprocess.run(['openclaw', 'gateway', 'status'], capture_output=True, text=True, timeout=10)
        if 'running' in result.stdout.lower() or result.returncode == 0:
            print_success("Gateway: 运行中")
            results['gateway'] = 'running'

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/quickstart.py (reported line 176)May include surrounding context.

python

# 已安装 Skills
    try:
        result = subprocess.run(['clawhub', 'list'], capture_output=True, text=True, timeout=10)
        if result.returncode == 0:
            lines = [l for l in result.stdout.strip().split('\n') if l.strip() and not l.startswith('-')]
            skill_count = len(lines)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language content forces a specific language for all user-facing instructions, and there is no opt-in, alternate language option, or justification that the skill is intended only for a Chinese-speaking region. This matches the policy category for language or locale constraints without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file promotes a one-stop flow that includes installation, configuration, and channel setup, but the user-facing description does not warn that these actions may change the local environment or write configuration. For markdown files, omission of warnings about behaviors affecting user data or system integrity is in scope for missing user warnings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

A natural-language policy concern exists because the skill documentation forces a specific language without indicating user opt-in or justified locale scope. There is no note that the content is region-specific or that alternative language support is available.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents all user-facing guidance exclusively in Chinese, and it does not indicate that the skill or documentation is region-specific or that users can choose another language. That can violate a language/locale policy requiring user choice or explicit justification for locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

SQP-3 applies to natural-language policy violations in any file type, including markdown. A skill document that effectively forces a specific language without user opt-in can violate language or locale policy when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower bound only (requests>=2.28.0), which makes builds non-reproducible and allows installation of unexpected future versions. This increases supply-chain risk and makes it difficult to verify whether a deployed environment includes a vulnerable or incompatible release.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# OpenClaw 新手一站式引导 - 依赖

# 可选：用于在线检测
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The manifest references requests without pinning an exact version, while that package has multiple historical advisories. Because the installed version is unconstrained above 2.28.0, consumers cannot verify from this file alone whether they will receive a patched or affected release, creating an avoidable dependency risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file is in scope for SQP-3, and nearly all user-facing strings, prompts, and help text are hard-coded in Chinese. The script does not provide any language selection, fallback, or opt-in mechanism, which is a natural-language locale policy concern when the skill may be used by a broader audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file presents all user-facing instructions in Chinese and does not indicate that users may choose another language. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.