Security audit

Openclaw Restart Resume

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for gateway restart follow-up, but its cron callback example uses shell-style dynamic placeholders in a high-impact restart workflow without clear argument-escaping guidance.

Review this skill before installing in production. It is not malicious, but operators should prefer a structured OpenClaw cron/task API or argument-array execution, validate route identifiers, and avoid shell interpolation for callback payloads. Install only where gateway restart authority and one-shot cron callbacks are intended.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: references/openclaw-cron-resume.md:8
Finding: Shell Command Injection Through Unescaped Cron Callback Parameters
Content: View full analysis
" \ --at +90s \ --agent \ --session isolated \ --light-context \ --tools gateway,message,exec \ --announce \ --account \ --channel \ --to \ --delete-after-run \ --timeout-seconds 120 \ --message '' ``` ### Technical Analysis The documented command directs an agent to substitute captured routing metadata and a generated callback message directly into a shell command. Dynamic values such as the agent identifier, account, channel, destination, and callback message are not required to undergo shell-safe encoding or strict format validation. The single quotes around the `--message` value are insufficient protection. An apostrophe within the generated content can terminate the quoted string, after which shell metacharacters may introduce additional commands. The other placeholders are unquoted and could permit argument injection, command substitution, redirection, or command chaining if their values contain shell-significant characters. The instruction that the routing payload be “sanitized” only prohibits secrets, transcripts, and unnecessary data. It does not define shell metacharacter filtering, identifier allowlists, or context-appropriate argument escaping. Consequently, an implementation that follows this template through a shell may be vulnerable. ### Attack Path 1. An attacker causes shell-significant content to enter routing metadata or another dynamic field used to construct the cron callback. Depending on the integration, this may occur through an attacker-contro ...[truncated 1519 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.