OpenClaw Workspace Doctor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:54 AM UTC
• Version: 0.1.0

Overview

The skill is purpose-aligned for troubleshooting OpenClaw workspaces, but its executable wrappers can load unreviewed Python code from outside the package and it can modify persistent OpenClaw configuration.

Review this skill before installing or running it. Do not run the included Python wrappers unless you trust the external workspace_doctor package they will import, and only allow the OpenClaw config fixer to write ~/.openclaw/openclaw.json after checking the proposed output or backup behavior.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/run_doctor.py:8

Finding

Untrusted Python Module Loading in Doctor Wrapper

Content

View full analysis

Vulnerability Details

File Location: scripts/run_doctor.py, lines 8–13
Vulnerability Type: Untrusted module path injection and local tool hijacking
Risk Level: High

Vulnerable Code:

python

ROOT = Path(__file__).resolve().parents[3]
SRC = ROOT / "src"
if str(SRC) not in sys.path:
    sys.path.insert(0, str(SRC))

from workspace_doctor.cli import main

Technical Analysis

The wrapper derives its source directory using Path(__file__).resolve().parents[3]. In the supplied project location, this resolves to /tmp, causing SRC to resolve to /tmp/src rather than a directory contained in the audited project.

The code then inserts /tmp/src at the beginning of sys.path, giving modules in that directory precedence over installed or otherwise trusted Python packages. The imported workspace_doctor.cli implementation is not included in the audited project, so the wrapper's effective executable behavior cannot be verified from the package.

This creates a Python module preloading vulnerability. A local attacker who can establish /tmp/src/workspace_doctor/cli.py can substitute an attacker-controlled implementation for the expected doctor tool. Importing that module executes its top-level code immediately, even before the wrapper calls main().

Attack Path

1. An attacker creates a Python package at /tmp/src/workspace_doctor.
2. The attacker adds a malicious cli.py exporting a compatible main function or executing code during import.
3. A user or AI Agent runs scripts/run_doctor.py.
4. The wrapper prepends /tmp/src to sys.path.
5. Python resolves workspace_doctor.cli from the attacker-controlled directory.
6. The malicious module executes with the permissions and environment of the invoking user.

Impact Assessment

Successful exploitation provides arbitrary Python code execution with the privileges of the user or Agent running the wrapper. The attacker could ...[truncated 423 chars]

Remediation

View remediation

Remediation Suggestions

• Package workspace_doctor inside the audited project and import it through the normal Python packaging mechanism.
• Do not prepend shared or externally controlled directories such as /tmp/src to sys.path.
• Derive repository-relative paths from a clearly defined project root rather than using a fixed parent depth.
• Prefer installing the package into an isolated virtual environment and invoking a declared console entry point.
• If dynamic path loading is unavoidable, verify that the target directory:
  • Is located within the expected project root.
  • Is not a symbolic link escaping that root.
  • Is owned by the expected user.
  • Is not writable by untrusted users.
  • Contains the expected, integrity-verified package files.
• Fail closed with a clear error when the bundled implementation cannot be found instead of searching a shared external path.
• Add tests asserting that the resolved import path remains inside the project directory.

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/fix_openclaw_config.py:8

Finding

Untrusted Python Module Loading in OpenClaw Configuration Fixer

Content

View full analysis

Vulnerability Details

File Location: scripts/fix_openclaw_config.py, lines 8–13
Vulnerability Type: Untrusted module path injection and security-tool spoofing
Risk Level: High

Vulnerable Code:

python

ROOT = Path(__file__).resolve().parents[3]
SRC = ROOT / "src"
if str(SRC) not in sys.path:
    sys.path.insert(0, str(SRC))

from workspace_doctor.fix_openclaw_config import main

Technical Analysis

This wrapper calculates ROOT by traversing three indexed parent entries above the script. In the supplied project location, the calculation makes SRC resolve to /tmp/src, which is outside the audited Skill package.

The wrapper places this external directory first in Python's module search path and imports workspace_doctor.fix_openclaw_config from it. The referenced implementation is absent from the audited project. Consequently, an attacker-controlled module under /tmp/src can spoof the expected configuration fixer and execute arbitrary code during import or when main() is called.

The issue is especially sensitive because the Skill documentation presents this wrapper as a companion to a tool that checks or modifies ~/.openclaw/openclaw.json. Users may therefore expect it to access account-level configuration and may trust configuration changes or status messages emitted by the substituted implementation.

Attack Path

1. An attacker creates /tmp/src/workspace_doctor/fix_openclaw_config.py.
2. The malicious module implements main or places a payload in its module initialization code.
3. A user or AI Agent invokes scripts/fix_openclaw_config.py, potentially intending to inspect or repair OpenClaw configuration.
4. The wrapper prioritizes /tmp/src in sys.path.
5. Python imports the attacker-controlled fixer instead of a trusted bundled implementation.
6. The payload runs with the invoking user's permissions and can spoof fixer output or alter user-accessible configura ...[truncated 678 chars]

Remediation

View remediation

Remediation Suggestions

• Include the configuration-fixer implementation in the audited package instead of importing it from an external shared directory.
• Remove the insertion of /tmp/src or any other shared writable location into sys.path.
• Use an installed, pinned package and a declared console entry point, preferably inside an isolated virtual environment.
• Validate that any repository-relative import directory remains beneath the canonical project root after resolving symbolic links.
• Reject import directories with unexpected ownership or permissions.
• Fail closed if the expected implementation is missing.
• Before modifying user configuration, validate the target path, preserve permissions, create backups safely, and use atomic file replacement.
• Add automated tests that verify the imported module's resolved file path is within the trusted project or installation directory.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs the agent to inspect and patch an external user configuration file under the user's home directory, but it does not clearly warn that this modifies user-owned configuration outside the workspace. That omission can lead to surprising persistent changes, especially in sandboxed or delegated execution contexts where users may assume actions are limited to the repo.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/commands.md (reported line 17)May include surrounding context.

md

- `python3 scripts/fix_openclaw_codex_config.py --check`
  - Return `ok` or `needs-change`.
- `python3 scripts/fix_openclaw_codex_config.py`
  - Patch the live OpenClaw config and create a timestamped backup first.
- `python3 scripts/fix_openclaw_codex_config.py --stdout`
  - Print the patched JSON without writing it.

Static analysis

No suspicious patterns detected.