T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:45- Finding
Gateway Token Disclosure Through Unredacted Command Output
- Content
View full analysis
- Remediation
View remediation
= 32) PY ``` ]]>
Security audit
Security Hardening Toolkit V1.0
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent security-hardening guide, but some recommended commands could expose secrets, create unsafe copies of sensitive files, or terminate unrelated processes.
Review and adapt the command snippets before installing or using this skill. Replace the gateway-token grep with a redacted or boolean check, create incident evidence directories with restrictive permissions before copying logs/config, and preview exact process IDs before killing anything. The artifact does not show exfiltration or hidden persistence, but its unsafe operational snippets justify Review.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:301- Finding
Incident Artifacts May Create Inadequately Protected Copies of Secrets
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:295- Finding
Broad Process-Matching Commands Can Terminate Unrelated Workloads
- Content
View full analysis
- Remediation
View remediation
` or the supported `openclaw gateway stop` command. - Use a trusted PID file or process supervisor to identify the intended processes. - Preview candidate processes with `pgrep -af` and require operator confirmation before termination. - Match exact executable names where possible instead of full command lines. - Restrict the action to a known user, service unit, container, cgroup, or process tree. - Attempt graceful termination first and use forced termination only after a timeout. - Avoid running broad process-killing commands with elevated privileges. A review-first pattern is: ```bash pgrep -af 'openclaw' # Confirm the exact PID belongs to the affected instance before continuing. kill -TERM -- ``` For a managed deployment, stop only the exact service unit associated with the affected instance. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (15)
YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]
Critical
- Category
- YARA Match
- Confidence
- 85% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
PURPOSE
This skill closes the five most exploited attack surfaces in live OpenClaw deployments: instance exposure, credential leakage, malicious skill installation, unauthorized gateway access, and post-compromise recovery.
Every section maps to a real threat vector. CVE-2026-25253 demonstrated that unprotected OpenClaw instances with public gateway endpoints are trivially exploitable. ClawHavoc demonstrated that skill installation is a reliable code execution path when no verification protocol exists. This toolkit addresses both.
SECTION 1: INSTANCE EXPOSURE AUDIT
Run this checklist before assuming your instance is protected.
1.1 — Network Exposure Check
bash # Check what ports OpenClaw gateway is binding on ss -tlnp | grep -E '18789|18790|18800' # Expected (safe): 127.0.0.1:18789 — gateway bound to loopback only # Dangerous: 0.0.0.0:18789 — gateway exposed to all interfaces # Check for external reachability (run from a different machine or use curl t
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## SECTION 2: CREDENTIAL PROTECTION ### 2.1 — .env File Isolation Rules Never store credentials in: - The workspace root (`~/.openclaw/workspace/*.env`)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # Audit current credential exposure find ~/.openclaw/workspace -name "*.env" -o -name ".env*" 2>/dev/null find ~/.openclaw/workspace -name "*.json" | xargs grep -l "sk_live\|rk_live\|ghp_\|re_" 2>/dev/null # If any hits: move credentials to /etc/default/aegis immediately
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # Audit current credential exposure find ~/.openclaw/workspace -name "*.env" -o -name ".env*" 2>/dev/null find ~/.openclaw/workspace -name "*.json" | xargs grep -l "sk_live\|rk_live\|ghp_\|re_" 2>/dev/null # If any hits: move credentials to /etc/default/aegis immediately
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Every section maps to a real threat vector. CVE-2026-25253 demonstrated that unprotected OpenClaw instances with public gateway endpoints are trivially exploitable. ClawHavoc demonstrated that skill installation is a reliable code execution path when no verification protocol exists. This toolkit addresses both. ---
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
bash # Audit current credential exposure find ~/.openclaw/workspace -name "*.env" -o -name ".env*" 2>/dev/null find ~/.openclaw/workspace -name "*.json" | xargs grep -l "sk_live\|rk_live\|ghp_\|re_" 2>/dev/null # If any hits: move credentials to /etc/default/aegis immediately
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
FERNET_KEY=<generated_value>
NEVER store in:
- openclaw.json (world-readable to agents)
- workspace files
- git repositories
text
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
FERNET_KEY=<generated_value>
NEVER store in:
- openclaw.json (world-readable to agents)
- workspace files
- git repositories
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md grep -iE "curl.*\$[A-Z_]+|wget.*\$[A-Z_]+" /path/to/SKILL.md grep -iE "base64|eval\s*\$|exec.*env\s" /path/to/SKILL.md grep -iE "SOUL\.md|AGENTS\.md|openclaw\.json" /path/to/SKILL.md grep -iE "cron|at\s+[0-9]|systemctl enable" /path/to/SKILL.md grep -iE "private_keys|system_configs|auth_files" /path/to/SKILL.md # Any hit = manual review required before activation
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Lock down the workspace directory ownership chmod 750 ~/.openclaw/workspace chmod 600 ~/.openclaw/workspace/*.md # Prevent world-readable credential files
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash # Lock down the workspace directory ownership chmod 750 ~/.openclaw/workspace chmod 600 ~/.openclaw/workspace/*.md # Prevent world-readable credential files chmod 600 /etc/default/aegis
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md chmod 600 ~/.openclaw/workspace/*.md # Prevent world-readable credential files chmod 600 /etc/default/aegis chown root:root /etc/default/aegis # or your agent user # Verify no sensitive files are in git-tracked locations
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md [ ] AGENTS.md audited for unauthorized changes [ ] HEARTBEAT.md audited [ ] Installed skills directory audited for unauthorized files [ ] Cron jobs audited: crontab -l and systemctl list-units --type=timer [ ] New gateway token set (minimum 32 hex chars) [ ] Gateway restarted with new config [ ] Incident logged in memory/YYYY-MM-DD.md with timeline
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md [ ] AGENTS.md audited for unauthorized changes [ ] HEARTBEAT.md audited [ ] Installed skills directory audited for unauthorized files [ ] Cron jobs audited: crontab -l and systemctl list-units --type=timer [ ] New gateway token set (minimum 32 hex chars) [ ] Gateway restarted with new config [ ] Incident logged in memory/YYYY-MM-DD.md with timeline
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
md ss -tlnp | grep -E '18789|18790|18800' # Audit credentials in workspace find ~/.openclaw/workspace -name "*.json" -o -name "*.env" | \ xargs grep -l "sk_\|rk_\|ghp_\|re_\|Bearer" 2>/dev/null # Check for unauthorized cron jobs
Static analysis
No suspicious patterns detected.