Security audit

claw-helper

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent OpenClaw help skill with no executable payload, but users should supervise any config or documentation changes it proposes.

Before installing, be aware that this skill may guide an agent to run OpenClaw CLI diagnostics, make OpenClaw configuration changes, and maintain local help notes or an index. Treat config edits as state-changing actions, review them before execution, and do not let troubleshooting notes store secrets, tokens, private logs, or account details.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill description is broad enough to activate on general OpenClaw support and troubleshooting requests, which can pull the agent into sessions where it is encouraged to run diagnostic or state-changing CLI commands. In combination with later instructions that normalize config changes and file edits, this increases the chance of unintended tool use without an explicit user request for modification.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The manifest description and primary instructions are written in Chinese and position the skill as a Chinese-language helper, but there is no indication that users may choose another language. The policy requires avoiding forced language or locale constraints unless there is explicit opt-in or a justified region-specific reason.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instruction to always use `openclaw config set <key> <value>` for configuration changes normalizes direct state modification without any warning, dry-run guidance, or confirmation requirement. That creates a risk of unauthorized or accidental system changes, especially because troubleshooting requests may be ambiguous and users may expect analysis rather than mutation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Automatically recording troubleshooting knowledge into `{{openclaw-help路径}}/reference/experience.md` instructs the agent to write to local files without user awareness or approval. This can unexpectedly alter repository contents, leak sensitive troubleshooting context into persistent storage, or create integrity issues in shared workspaces.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The instruction to update the index document when it differs from local state authorizes documentation edits as part of normal execution, again without notification or approval. Even if intended as maintenance, this permits unrequested file modification and could corrupt docs or introduce inaccurate changes during routine support interactions.

Natural-Language Policy Violations

Low

Confidence: 81% confidence
Finding: The file content is entirely written in Chinese and provides no indication that users can choose another language or locale. Under the policy rule for language/locale, this can be interpreted as a fixed language experience without explicit opt-in or justification.

Static analysis

No suspicious patterns detected.