OpenClaw Migration

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:17 PM UTC
• Version: 1.0.1

Overview

This skill is a cautious migration helper that clearly asks for confirmation before installing software, backing up, or performing a real restore.

Before installing, confirm that @clawmover/cli is the intended package from the expected publisher and consider using a pinned version or isolated environment. Treat the data secret key and verification codes as sensitive, and prefer simulated restore before a live restore.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned External CLI Dependency Executes with Access to Sensitive Migration Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:23-29
Vulnerability Type: Unpinned and unverifiable third-party executable dependency
Risk Level: Medium

Complete Snippet:

markdown

## Runtime Dependency

This skill depends on the published CLI package `@clawmover/cli`.

If the CLI is missing, do not install it silently.

First explain the installation step and offer two options:

- provide the install command for the user to run manually
- run the install command only after explicit confirmation

The installation behavior is further defined at SKILL.md:102-107:

markdown

## Install Or Verify CLI

First check whether `clawmover` is available.

If it is missing:

- explain that this skill requires `@clawmover/cli`
- explain that installation modifies the host environment
- offer the manual install command
- only run the install command after explicit confirmation

Technical Analysis

The skill relies on the external @clawmover/cli package for its backup and restore operations. However, the project does not specify an audited version, integrity hash, lockfile, trusted registry configuration, package signature, or reproducible source reference.

Requiring confirmation prevents silent installation, but it does not verify the identity or integrity of the artifact ultimately installed. An unpinned package reference can resolve to a future release whose contents differ from those reviewed. Registry compromise, publisher-account compromise, or dependency substitution could therefore introduce hostile package code or installation scripts.

This dependency is security-sensitive because the documented workflows provide it with dataSecretKey, migration identifiers, verification codes, and filesystem access required for backup or restoration.

Attack Path

1. An attacker compromises the package publisher, registry distribution path, or a dependency included in a future `@cl ...[truncated 1336 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @clawmover/cli to a specific, reviewed version rather than referring to the package without a version.
2. Record and verify the expected package integrity hash or cryptographic signature before installation.
3. Explicitly identify the trusted registry and verified publisher; reject installation from alternate registries or ambiguous package sources.
4. Maintain a lockfile or equivalent dependency manifest covering the CLI and its transitive dependencies.
5. Audit the exact package artifact, including package-manager lifecycle scripts, before approving a version.
6. Prefer an isolated, least-privilege execution environment rather than a global installation.
7. Disable package lifecycle scripts during installation where compatible with the CLI.
8. Avoid exposing secrets through command-line arguments or logs. Pass them through a protected input mechanism and ensure the child process receives only the minimum required environment and filesystem access.
9. Document a trusted upgrade procedure requiring renewed integrity verification and security review whenever the pinned version changes.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

- never repeat the full `dataSecretKey`
- never include the full key in examples, logs, or summaries
- mask sensitive values in displayed commands unless the user explicitly asks for the exact command text
- do not ask the user to paste sensitive values again unless necessary

## Install Or Verify CLI

Static analysis

No suspicious patterns detected.