ClawHub
Back to skill

Security audit

Openclaw Agent Governance

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed workspace governance helper that creates or checks agent memory and instruction files, with no evidence of hidden code, credential use, network access, or destructive behavior.

Install only if you want persistent governance and memory files in an OpenClaw workspace. Before running apply, confirm the workspace path, back up existing AGENTS.md or MEMORY.md if they matter, and inspect any local agent-governance command or templates because they are referenced but not bundled in this artifact.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The apply workflow performs filesystem changes—creating directories and generating or appending files—without a prominent upfront warning that it modifies the target workspace. In an agent setting, insufficient disclosure can cause unintended writes, especially if the workspace path is user-supplied or inferred incorrectly, leading to integrity issues or accidental modification of existing project governance files.

Static analysis

No suspicious patterns detected.