Security audit

API Health Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it locally scans recent OpenClaw session logs for API error patterns, but users should understand those logs may contain sensitive conversation data.

Install only if you are comfortable with a local tool reading recent OpenClaw session log files, which may include sensitive prompts or operational details. Prefer running it deliberately for troubleshooting rather than as an always-on monitor, and consider adding size and symlink checks before using it in shared or untrusted environments.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: index.js:4
Finding: Broad Access to Sensitive Agent Session Logs
Content: View full analysis
f.endsWith('.jsonl') || f.endsWith('.log') || f.endsWith('.json')) .map(f => { const full = path.join(SESSIONS_DIR, f); const stat = fs.statSync(full); return { path: full, mtime: stat.mtimeMs }; }) .filter(f => f.mtime >= cutoff) .sort((a, b) => b.mtime - a.mtime); } async function checkApiHealth(opts = {}) { const maxAgeDays = opts.maxAgeDays || 1; const files = recentSessionFiles(maxAgeDays); const errorMap = {}; for (const file of files) { let content; try { content = fs.readFileSync(file.path, 'utf8'); } catch { continue; } ``` ### Technical Analysis The Skill directly targets the main Agent session directory and enumerates every recent file with a `.jsonl`, `.log`, or `.json` extension. It then loads each selected file in full, even though its stated purpose only requires API-health error telemetry. Agent session logs can contain private conversation content, tool output, credentials, API tokens, filesystem paths, and other sensitive operational state. The implem ...[truncated 2309 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documentation declares no explicit tool scope or permissions, yet the described behavior requires access to local session logs and the static analyzer detected env/network capabilities. This creates an authorization and review gap: consumers cannot easily tell what resources the skill may access, and an over-privileged runtime could permit unintended data exposure or external transmission of log-derived information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill reads OpenClaw session logs directly from the user's home directory, which can expose sensitive prompts, responses, API errors, tokens, or other operational data without any explicit consent or disclosure in the code. In this skill's context, parsing session logs is core functionality, but that same context increases risk because session logs commonly contain confidential conversation and credential-adjacent material.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.