OpenGuardrails

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:12 AM UTC
• Version: 6.8.20

Overview

MoltGuard is a coherent security skill, but installing it would add a mutable third-party plugin that can route sensitive agent security data to an external Core service with limited disclosure.

Review this before installing in any environment with confidential prompts, customer data, credentials, or regulated information. Confirm the exact plugin version and publisher provenance, what Core endpoint is used, what data is transmitted, retention/deletion terms, credential handling, and how to disable or revoke access. Use enterprise enrollment only with a Core endpoint you administratively trust.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Unpinned Third-Party Plugin Installation and Update<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 16-20; related update instructions at lines 155-159 **Vulnerability Type**: Supply-chain exposure through an unpinned executable dependency **Risk Level**: Medium ### Code Snippet ```markdown When the human asks to install MoltGuard, or when you want to protect yourself: ```bash # Install the plugin openclaw plugins install @openguardrails/moltguard ``` ``` Related update instructions: ```markdown To update MoltGuard to the latest version: ```bash # Update the plugin openclaw plugins update moltguard ``` ``` ### Technical Analysis The Skill instructs the agent or user to install and update a third-party plugin without specifying an exact audited version, integrity hash, or signature. The executable implementation is not included in the audited project, which contains only `SKILL.md`. Consequently, the behavior of the installed package and its transitive dependencies cannot be verified from this artifact. Resolving a mutable package identifier at installation or update time allows the effective code to change after the Skill has been reviewed. The referenced source repository does not, by itself, cryptographically establish that the package obtained by the OpenClaw package manager corresponds to reviewed source code. This is a supply-chain risk rather than evidence that the current upstream package is malicious. ### Attack Path 1. An attacker compromises the package publisher account, package registry, release workflow, or a transitive dependency. 2. The attacker publishes a modified release under the expected package name. 3. A user or agent follows the Skill's installation or update instructions. 4. The package manager resolves the mutable package identifier to the compromised release. 5. The modified plugin executes within the OpenClaw environment and inherits the permissions available to the plugin runtime. ### Impact Assessment A compromised plugin could potentially access ...[truncated 419 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin installation to an exact, independently audited plugin version rather than a mutable package identifier. - Verify the package using a trusted integrity hash, signature, or package-manager lock mechanism. - Document the expected registry, publisher identity, source commit, and reproducible relationship between the source and distributed artifact. - Review and lock transitive dependencies before deployment. - Require explicit user approval before installation or update instead of allowing installation merely because the agent “wants to protect itself.” - Run the plugin with least privilege, restricting filesystem access, command execution, credential access, and outbound network destinations. - Test updates in an isolated environment before deploying them to production OpenClaw instances. ]]>

other

Warning

• Location: SKILL.md:86
• Finding: Opaque External Processing of Potentially Sensitive Detection Inputs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 86-94 **Vulnerability Type**: Undisclosed external data processing and trust-boundary exposure **Risk Level**: Medium ### Code Snippet ```markdown All security detection is performed by Core: **Core Risk Surfaces:** 1. **Prompt / Instruction Risk** — Prompt injection, malicious email/web instructions, unauthorized tasks 2. **Behavioral Risk** — Dangerous commands, file deletion, risky API calls 3. **Data Risk** — Secret leakage, PII exposure, sending sensitive data to LLMs **Core Technology:** - **Intent-Action Mismatch Detection** — Catches agents that say one thing but do another ``` ### Technical Analysis The Skill states that all security detection is performed by an external service called “Core.” Detection of prompt content, behavioral actions, secret leakage, and PII may require transmitting sensitive inputs or derived data beyond the local OpenClaw trust boundary. The documentation does not identify the default public service endpoint, exact transmitted fields, transport and authentication controls, retention policy, geographic processing location, redaction behavior, or whether users can opt out. The implementation needed to determine whether full content, metadata, hashes, or redacted excerpts are transmitted was not included in the project. The use of a remote security service may be necessary for the declared functionality, but processing potentially sensitive content without clear disclosure and controls creates confidentiality and compliance risk. ### Attack Path 1. The plugin observes prompts, files, web content, commands, or API activity for security analysis. 2. Detection inputs or related telemetry are sent to the external Core service. 3. The transmitted material includes or reveals credentials, PII, confidential content, or behavioral metadata. 4. The external service, its infrastructure, logs, subprocessors, or a compromised service account gains access to that ...[truncated 722 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Explicitly document every default and enterprise Core endpoint. - Describe the exact payload schema, including whether raw prompts, files, commands, PII, credentials, or derived metadata are transmitted. - Obtain informed user or administrator consent before enabling remote inspection. - Redact credentials, authentication tokens, PII, and unrelated content locally before transmission. - Minimize payloads to the smallest excerpts or features necessary for detection. - Enforce TLS certificate validation and restrict outbound traffic to documented allowlisted endpoints. - Publish retention, deletion, regional processing, logging, and subprocessor policies. - Provide a local-only or disabled mode for sensitive environments. - Ensure enterprise endpoint configuration cannot redirect security data to arbitrary untrusted destinations without administrator authorization. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents automatic retrieval and storage of an API key in a local credentials directory without any warning about sensitivity, file permissions, rotation, or what account the key authorizes. This can lead users or downstream agents to expose, mishandle, or overtrust the stored credential, especially because the same section frames activation as automatic and zero-intervention.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The enterprise enrollment flow changes the backend endpoint to a private Core instance, but the documentation does not clearly warn that future security events, prompts, or metadata may be routed to a different service under different administrative control. This creates a real trust-boundary change and can cause unintended data disclosure if a user or agent enrolls without understanding where data will go.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The uninstall section provides a destructive command and only afterward notes that config, plugin files, and credentials are removed. For irreversible cleanup affecting user data and local configuration, the section should warn users before the command so they understand the impact in advance.

Static analysis

No suspicious patterns detected.