ClawHub
Back to skill

Security audit

openclaw omni expert

Security checks for vulnerabilities and agentic risk

Overview

This is a powerful remote-control and auto-repair skill whose core purpose is disclosed, but it gives agents broad unattended authority to change local or remote computers.

Install only if you intentionally want an agent to perform remote support and automated system repair. Review commands before running autopilot or fix-all modes, use least-privileged remote accounts, avoid production machines unless you have backups, and do not provide SSH keys, API keys, screenshots, or remote session credentials unless you trust the publisher and the target workflow.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (98)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
cmd.append(command)

        try:
            result = subprocess.run(
                cmd,
                capture_output=True,
                text=True,
Confidence
95% confidence
Finding
This code appends an arbitrary command string to an ssh invocation and executes it on the remote host without any policy validation, confirmation, or restriction. In this skill, task steps include package installation, process killing, service restart, and network fetches, so any caller or upstream workflow that can influence the command stream gains broad remote code execution on the target system.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
gpu_info = {"available": False}
        try:
            if platform.system() == "Linux":
                result = subprocess.run(
                    ["lspci", "|", "grep", "-i", "nvidia"],
                    capture_output=True,
                    text=True,
Confidence
92% confidence
Finding
This subprocess call enables shell=True while passing what appears to be a pipeline as a list, which is both unsafe and error-prone. Although the current command string is hardcoded, using the shell unnecessarily increases exposure to shell-based execution risks and establishes a dangerous pattern in a tool that inspects the host environment.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
            if system == "darwin":  # macOS
                # 使用 Homebrew
                subprocess.run(["brew", "install", "node@22"], check=True)
                subprocess.run(["brew", "link", "node@22"], check=True)

            elif system.startswith("linux"):
Confidence
82% confidence
Finding
This script performs package installation automatically without any user confirmation. In an agent skill context, silently installing software can have significant security and integrity implications, especially if triggered from automated diagnosis or repair flows.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if system == "darwin":  # macOS
                # 使用 Homebrew
                subprocess.run(["brew", "install", "node@22"], check=True)
                subprocess.run(["brew", "link", "node@22"], check=True)

            elif system.startswith("linux"):
                # 使用 nvm
Confidence
82% confidence
Finding
Automatically linking a Homebrew package alters the runtime environment and may affect other software. In a remotely triggered support/automation skill, this kind of system modification should not occur without informed user approval.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
            if system == "darwin":
                subprocess.run(["brew", "install", "git"], check=True)
            elif system.startswith("linux"):
                # 检测发行版
                if Path("/etc/debian_version").exists():
Confidence
81% confidence
Finding
Installing Git via Homebrew modifies the host system and may be triggered as part of automated remediation. The danger is not injection, but unauthorized or unexpected system change in an automation context.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
            if system == "darwin":
                subprocess.run(["brew", "install", "python@3.11"], check=True)
            elif system.startswith("linux"):
                if Path("/etc/debian_version").exists():
                    subprocess.run(["sudo", "apt-get", "install", "-y", "python3.11"], check=True)
Confidence
81% confidence
Finding
This automatic Python installation changes the local system state and may be executed without adequate user awareness. In an agent skill that advertises automated fixing and remote support capabilities, this increases operational risk.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# Linux/macOS 权限修复
            # 修复 openclaw 目录权限
            if self.openclaw_dir.exists():
                subprocess.run(
                    ["chown", "-R", str(os.getlogin()), str(self.openclaw_dir)],
                    check=True
                )
Confidence
87% confidence
Finding
Recursively changing ownership of the OpenClaw directory can alter file access semantics and may damage security boundaries or application behavior if run in the wrong context. The command is fixed, but it is a privileged and potentially destructive operation executed automatically.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
            if "文件或目录不存在" in issue["issue"]:
                # 重新安装 OpenClaw
                subprocess.run(["npm", "install", "-g", "openclaw@latest"], check=True)
                print("  OpenClaw 已重新安装")

            return True
Confidence
83% confidence
Finding
Automatically reinstalling a package globally changes the system and may pull new code from an external registry without user review. In a support automation skill, this expands the trust boundary and can be risky if triggered unexpectedly.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
rc_file = bash_rc

                # 加载 nvm 并安装
                subprocess.run(
                    f'. {rc_file} && nvm install 22 && nvm use 22 && nvm alias default 22',
                    shell=True,
                    check=True
Confidence
96% confidence
Finding
This uses `shell=True` with a formatted command string that sources a shell RC file and executes multiple commands. Even though `rc_file` is locally chosen, sourcing user-controlled shell startup files means arbitrary commands in those files will execute during repair, creating a code execution path.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
nvm_dir = self.home_dir / ".nvm"
                if not nvm_dir.exists():
                    print("  安装 nvm...")
                    subprocess.run(
                        "curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash",
                        shell=True,
                        check=True
Confidence
99% confidence
Finding
This downloads a remote script and pipes it directly to `bash` with `shell=True`, which creates an immediate remote code execution supply-chain risk. If the network, upstream repository, or transport is compromised, arbitrary code runs on the host during auto-fix.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
elif system.startswith("linux"):
                # 检测发行版
                if Path("/etc/debian_version").exists():
                    subprocess.run(["sudo", "apt-get", "install", "-y", "git"], check=True)
                elif Path("/etc/redhat-release").exists():
                    subprocess.run(["sudo", "yum", "install", "-y", "git"], check=True)
            elif system == "win32":
Confidence
82% confidence
Finding
Running `sudo apt-get install -y git` as part of automatic remediation performs privileged software installation without a confirmation step. In an automation/agent context this is security-significant because it modifies the system and may be socially triggered through diagnosis flows.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
subprocess.run(["brew", "install", "python@3.11"], check=True)
            elif system.startswith("linux"):
                if Path("/etc/debian_version").exists():
                    subprocess.run(["sudo", "apt-get", "install", "-y", "python3.11"], check=True)
                elif Path("/etc/redhat-release").exists():
                    subprocess.run(["sudo", "yum", "install", "-y", "python3"], check=True)
            elif system == "win32":
Confidence
82% confidence
Finding
This is another privileged package installation executed automatically. The issue is not injection but unauthorized or insufficiently-consented host modification through a repair script.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
system = sys.platform
                if system == "win32":
                    install_script = Path(__file__).parent / "install_openclaw.ps1"
                    subprocess.run(["powershell", "-ExecutionPolicy", "Bypass", "-File", str(install_script)], check=True)
                else:
                    install_script = Path(__file__).parent / "install_openclaw.sh"
                    subprocess.run(["bash", str(install_script)], check=True)
Confidence
80% confidence
Finding
Executing a local install script via PowerShell bypasses execution policy and can materially change the host system. In a support skill with automation and remote-control positioning, silently launching such installers is risky and should be tightly gated.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
subprocess.run(["powershell", "-ExecutionPolicy", "Bypass", "-File", str(install_script)], check=True)
                else:
                    install_script = Path(__file__).parent / "install_openclaw.sh"
                    subprocess.run(["bash", str(install_script)], check=True)
                print("  OpenClaw 已安装")

            elif "端口被占用" in issue["issue"]:
Confidence
79% confidence
Finding
Running a local shell installer from the script directory can execute arbitrary installation logic without prior review by the user. This is especially sensitive in an auto-fix tool intended for broad troubleshooting automation.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if Path("/etc/debian_version").exists():
                    subprocess.run(["sudo", "apt-get", "install", "-y", "git"], check=True)
                elif Path("/etc/redhat-release").exists():
                    subprocess.run(["sudo", "yum", "install", "-y", "git"], check=True)
            elif system == "win32":
                # Windows 使用 winget 或 chocolatey
                if shutil.which("winget"):
Confidence
82% confidence
Finding
This privileged yum installation modifies the host without an interactive confirmation step. In an agent-driven repair workflow, such automatic package changes increase the chance of unintended system impact.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
elif system == "win32":
                # Windows 使用 winget 或 chocolatey
                if shutil.which("winget"):
                    subprocess.run(["winget", "install", "--id", "Git.Git", "-e", "--silent"], check=True)
                elif shutil.which("choco"):
                    subprocess.run(["choco", "install", "git", "-y"], check=True)
                else:
Confidence
80% confidence
Finding
This line silently installs Git via winget, changing the Windows host state through automated remediation. The risk comes from automatic software installation in a troubleshooting skill, not from command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if Path("/etc/debian_version").exists():
                    subprocess.run(["sudo", "apt-get", "install", "-y", "python3.11"], check=True)
                elif Path("/etc/redhat-release").exists():
                    subprocess.run(["sudo", "yum", "install", "-y", "python3"], check=True)
            elif system == "win32":
                # Windows 使用 winget 或 chocolatey
                if shutil.which("winget"):
Confidence
82% confidence
Finding
Automatic yum-based Python installation changes the system and may be triggered as part of unattended remediation. In this skill context, that is a genuine security and safety concern.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
elif system == "win32":
                # Windows 使用 winget 或 chocolatey
                if shutil.which("winget"):
                    subprocess.run(
                        ["winget", "install", "Python.Python.3.11", "--silent"],
                        check=True
                    )
Confidence
80% confidence
Finding
This invokes winget to install Python silently, which modifies the host system without explicit user confirmation. Silent installs are risky in automation because they reduce visibility and consent.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if shutil.which("winget"):
                    subprocess.run(["winget", "install", "--id", "Git.Git", "-e", "--silent"], check=True)
                elif shutil.which("choco"):
                    subprocess.run(["choco", "install", "git", "-y"], check=True)
                else:
                    print("  请访问 https://git-scm.com/download/win 下载安装")
                    return False
Confidence
80% confidence
Finding
This silently installs Git through Chocolatey, changing the host system through automated repair. The vulnerability is unsafe automation of software installation without consent, not command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
check=True
                    )
                elif shutil.which("choco"):
                    subprocess.run(["choco", "install", "python", "-y"], check=True)

            # 验证安装
            result = subprocess.run(["python3", "--version"], capture_output=True, text=True)
Confidence
80% confidence
Finding
This installs Python via Chocolatey without a confirmation step. In the context of a repair tool that may be invoked automatically, this is a meaningful security risk due to unreviewed system modification.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print(f"  检测到占用进程 PID: {pid}")

                            # 终止进程
                            subprocess.run(["kill", pid], check=True)
                            print(f"  已终止进程 {pid}")

                            # 启动服务
Confidence
95% confidence
Finding
This line kills a process based solely on port-ownership parsing, without validating that the process is safe to terminate or belongs to OpenClaw. An unrelated local process using that port could be terminated, causing denial of service or disruption.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def _default_exec(self, command: str) -> Tuple[bool, str]:
        """默认通过 uu exec 执行"""
        try:
            result = subprocess.run(
                ["uu", "exec", "--", command],
                capture_output=True,
                text=True,
Confidence
93% confidence
Finding
The code passes a dynamically constructed command string into `uu exec`, which then executes it on a remote Windows host. Multiple public methods build that command from user-controlled values, so this creates a real command-injection and arbitrary remote-execution surface even though `subprocess.run` itself is invoked with a list.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
            # 通过 UU exec 执行命令
            cmd = ["uu", "exec", "--", command]
            result = subprocess.run(
                cmd,
                capture_output=True,
                text=True,
Confidence
84% confidence
Finding
While subprocess.run is used safely from a local shell-injection perspective, this call exposes arbitrary remote command execution through the UU CLI with no authorization checks, command restrictions, or confirmation. In an agent skill designed for remote control, that materially increases the danger because untrusted prompts or workflow inputs could cause destructive commands to be run on a remote machine.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
import subprocess
            # RDP 需要配合 PsExec 或 SSH 执行命令
            try:
                result = subprocess.run(
                    ["ssh", f"{self.conn.username}@{self.conn.host}", command],
                    capture_output=True,
                    text=True,
Confidence
94% confidence
Finding
This method exposes arbitrary remote command execution over SSH using a caller-supplied command with no validation, policy checks, or safety gating. In the context of an agent skill for remote control and automation, this materially increases the chance of unauthorized code execution on remote systems if the skill is misused or triggered by untrusted input.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"-Command",
                    f"Invoke-Command -ComputerName {self.conn.host} -Credential (Get-Credential) -ScriptBlock {{{command}}}"
                ]
                result = subprocess.run(
                    cmd,
                    capture_output=True,
                    text=True,
Confidence
97% confidence
Finding
The code interpolates untrusted host and command data into a PowerShell Invoke-Command string, creating a command-construction sink that can execute arbitrary PowerShell on a remote machine. Because this skill is explicitly designed for remote administration and automation, abuse of this path could directly lead to remote compromise, destructive changes, or lateral movement.

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
references/troubleshooting-guide.md:443

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
references/troubleshooting.md:195

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/remote-helper.py:51

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/universal_remote.py:76

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/intelligent_diagnose.py:114

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/knowledge_base_manager.py:143