Security audit

Claw Doctor

Security checks for vulnerabilities and agentic risk

Overview

This troubleshooting skill is mostly coherent, but it includes unsafe repair commands that can expose secrets or run untrusted local code.

Install only if you are comfortable reviewing each command before it runs. Do not print API keys, avoid pasting health-check output into shared chats without redaction, do not execute a script found by broad find commands unless you verify the exact path, and review dependency manifests before running pip or npm installs.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:112
Finding: Ambiguous Script Discovery Can Execute an Attacker-Controlled Local Tool
Content: View full analysis
/dev/null | head -1) # Fallback: check workspace skills [ -z "$MY_SCRIPT" ] && MY_SCRIPT=$(find ./skills -name "run" -path "*/my-skill/scripts/*" -type f 2>/dev/null | head -1) if [ -z "$MY_SCRIPT" ]; then echo "ERROR: script not found. Is the skill installed?" exit 1 fi $MY_SCRIPT ``` ### Technical Analysis The procedure searches broad, potentially user-writable directory trees and executes the first file whose name and path match a pattern. It does not establish a trusted installation root, verify the selected file's owner or permissions, reject symbolic links, validate file integrity, or confirm that the result belongs to the intended Skill installation. The use of `head -1` makes executable selection dependent on filesystem traversal order. An attacker who can create files under a searched workspace or OpenClaw directory may introduce a matching `run` file and cause it to be selected instead of the legitimate script. The variable is also executed without quoting, making paths containing whitespace or shell metacharacters unreliable and potentially increasing command interpretation risks. ### Attack Path 1. An attacker obtains write access to a workspace Skill directory or another location under the searched OpenClaw tree. 2. The attacker creates an executable file named `run` under a path matching `*/my-skill/*/scripts/*` or `*/my-skill/scripts/*`. 3. A user reports a script-resolution problem, causing the Agent to follow this repair procedure. 4. The broad `find` command locates the attacker's file as its first result. 5. The Agent executes the selected path through `$MY_SCRIPT `. 6. The attacker's script runs with the operating-system privileges ...[truncated 493 chars]
Remediation: View remediation
` to prevent word splitting. - If multiple installations are found, stop and require the user to select the intended trusted installation rather than choosing one implicitly. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:145
Finding: API Key Verification Exposes Credential Material in Command Output
Content: View full analysis
.key 2>/dev/null | head -c 20 ``` ### Technical Analysis The proposed verification procedure reads and prints the first 20 bytes of an API key. Terminal output may be copied into Agent context, conversation history, command transcripts, CI logs, screen recordings, or other monitoring systems. For keys of 20 bytes or fewer, this command can disclose the entire credential. For longer keys, it exposes a prefix that may still reveal the provider, account format, or enough credential material to reduce the key's effective secrecy. Verifying that a key was saved does not require displaying any part of its value. ### Attack Path 1. A user reports an API authentication or setup problem. 2. The Agent follows the documented verification procedure. 3. The command reads the secret file and emits up to 20 bytes of the API key. 4. The output enters the terminal and potentially the Agent's retained conversation or execution logs. 5. Anyone with access to those outputs obtains part or all of the credential. 6. If the complete key is exposed, it may be used directly against the associated service; a partial disclosure may assist credential identification or targeted attacks. ### Impact Assessment The issue can disclose part or all of a user-level API credential to terminal observers and logging systems. The resulting service access depends on the permissions attached to the key and may include reading private data, consuming paid API quota, modifying remote resources, or impersonating the user to the affected service. ]]>
Remediation: View remediation
.key" ]; then echo "API key file is present and nonempty." else echo "API key file is missing or empty." fi ``` - Validate restrictive permissions without reading the value, such as requiring mode `0600`. - Redact credentials from Agent output, shell tracing, debug logs, and error messages. - If credential exposure may already have occurred, revoke and rotate the affected key. ]]>

T08 · Insecure Dependencies

Error

Location: SKILL.md:180
Finding: Unreviewed Dependency Installation Can Execute Supply-Chain Payloads
Content: View full analysis
/requirements.txt 2>/dev/null \ || echo "No requirements.txt found" ``` ```bash cd skills/ && npm install 2>/dev/null \ || echo "No package.json found" ``` ### Technical Analysis The repair instructions recommend installing dependencies directly from manifests belonging to the Skill being diagnosed. They do not require inspection of package names, use of trusted registries, pinned versions, lockfiles, hashes, signatures, or an isolated environment. Python package installation can execute build backends or setup code during package build and installation. `npm install` can execute dependency lifecycle hooks such as `preinstall`, `install`, and `postinstall`. Therefore, a malicious or compromised manifest or upstream package may obtain code execution as the Agent user during what appears to be routine dependency repair. Redirecting standard error to `/dev/null` also conceals warnings and diagnostic information that might otherwise reveal suspicious package sources or lifecycle behavior. ### Attack Path 1. An attacker compromises a Skill directory, dependency manifest, package registry account, or referenced package. 2. The attacker adds a malicious dependency, redirects a package to an unsafe source, or embeds a malicious installation lifecycle hook. 3. The user encounters a dependency-related failure and invokes the doctor procedure. 4. The Agent runs `pip3 install -r ...` or `npm install` without reviewing or constraining the dependency graph. 5. The package manager downloads or builds attacker-controlled content. 6. Installation or lifecycle code executes with the privileges of the Agent user. 7. The payload can access the workspace, user files, environment variables, and other resources available to that acc ...[truncated 410 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: SKILL.md:263
Finding: Full Health Check Unnecessarily Enumerates Secret and Environment Metadata
Content: View full analysis
/dev/null || echo "(none)" && \ echo "--- Workspace skills ---" && ls ./skills/ 2>/dev/null || echo "(none)" && \ echo "--- Secrets ---" && ls ~/.openclaw/secrets/ 2>/dev/null || echo "(none)" && \ echo "--- Plugin cache ---" && ls ~/.openclaw/plugins/cache/ 2>/dev/null | head -5 || echo "(empty)" && \ echo "--- Dependencies ---" && \ node --version 2>/dev/null && \ python3 --version 2>/dev/null && \ jq --version 2>/dev/null && \ echo "=== Done ===" ``` ### Technical Analysis The generic health check inventories global and workspace Skills, secret filenames, plugin-cache entries, and installed tool versions. These checks are performed as a single broad procedure even though many reported failures do not require all of this information. Although the command does not read secret values or transmit results over the network, secret filenames can reveal configured providers, integrations, account purposes, or operational capabilities. Skill names, cache entries, and dependency versions provide additional system profiling data. When executed through an Agent, these details may be incorporated into conversation history or diagnostic logs. This finding concerns excessive access and disclosure relative to the diagnostic need; the audited file does not contain evidence of privilege elevation or external exfiltration. ### Attack Path 1. A user invokes the Skill for a routine or narrowly scoped OpenClaw problem. 2. The Agent follows the instruction to run the complete health check. 3. The command enumerates the names of secret files, installed Skills, cache content, and tool versions. 4. The resulting inventory is emitted into terminal output and potentially r ...[truncated 577 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
1. Is the `SKILL.md` actually present and readable?

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.
md
1. Is the `SKILL.md` actually present and readable?

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs users to inspect the secrets directory and print part of a stored API key with cat ... | head -c 20 without any warning about credential exposure. Even partial secret disclosure can leak prefixes, key formats, or live credentials into terminal history, logs, screenshots, or chat transcripts during troubleshooting.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The skill recommends persisting SKILL_API_KEY in ~/.zshrc or ~/.bashrc, which stores secrets in plaintext in broadly read shell startup files and can lead to accidental disclosure through backups, dotfile sync, screen sharing, or repository commits. This is not immediately exploitable on its own, but it weakens secret hygiene and increases the blast radius of local compromise.
Content: Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
If no setup command exists, ask the user to set the env var directly:

bash
export SKILL_API_KEY="their-key-here" # Add to ~/.zshrc or ~/.bashrc for persistence

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The health-check workflow lists the entire ~/.openclaw/secrets/ directory as part of a general diagnostic snapshot, which can expose sensitive filenames, service usage, or operational details when copied into bug reports or shared outputs. While less severe than printing secret contents, it still increases credential-related information exposure during routine debugging.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.