ClawHub
Back to skill

Security audit

Healthcheck

Security checks for vulnerabilities and agentic risk

Overview

This skill performs host security checks and hardening guidance with explicit approvals and no hidden payloads.

Install this only if you are comfortable letting the agent inspect local security posture such as firewall state, listening services, update status, and OpenClaw audit output. Review any proposed firewall, SSH, service, package, cron, or memory-write action before approving it, and avoid saving raw outputs that contain hostnames, IP addresses, usernames, or service details unless needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Note
Location
SKILL.md:31
Finding

Broad Host and Network Security Reconnaissance

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–45; supporting enumeration commands appear at lines 75–87
Vulnerability Type: other: Environment Reconnaissance
Risk Level: Low

Complete Code Snippet

markdown
### 1) Establish context (read-only)

Try to infer 1–5 from the environment before asking. Prefer simple, non-technical questions if you need confirmation.

Determine (in order):

1. OS and version (Linux/macOS/Windows), container vs host.
2. Privilege level (root/admin vs user).
3. Access path (local console, SSH, RDP, tailnet).
4. Network exposure (public IP, reverse proxy, tunnel).
5. OpenClaw gateway status and bind address.
6. Backup system and status (e.g., Time Machine, system images, snapshots).
7. Deployment context (local mac app, headless gateway host, remote gateway, container/CI).
8. Disk encryption status (FileVault/LUKS/BitLocker).
9. OS automatic security updates status.

Supporting commands at lines 75–87 direct the Agent to enumerate listening ports and firewall configuration using utilities such as ss, lsof, ufw, firewall-cmd, and nft.

Technical Analysis

The Skill directs the Agent to collect a broad set of security-sensitive environmental details, including privilege level, remote-access methods, public exposure, gateway binding, listening ports, and firewall configuration. Collectively, these details provide a structured description of the host's attack surface and defensive posture.

This behavior is consistent with the Skill's declared host-hardening purpose and is guarded by a request for read-only permission. The file does not instruct the Agent to transmit the results externally, bypass access controls, or make unauthorized changes. Consequently, this is not classified as privilege escalation or malicious code execution. The residual concern is that raw reconnaissance results may remain in the conversation context or audit records and ...[truncated 1601 chars]

Remediation
View remediation

Remediation Suggestions

  1. Separate consent for basic system identification from consent for network, privilege, and service enumeration.
  2. Explain before collection that listening-port, firewall, bind-address, and remote-access results may expose security-sensitive topology.
  3. Collect only information required for the selected audit profile rather than gathering every available category by default.
  4. Redact public IP addresses, hostnames, usernames, interface identifiers, and uncommon service names from displayed or retained output.
  5. Summarize command results instead of retaining complete raw output unless the user explicitly requests it.
  6. Define retention boundaries for reconnaissance output and avoid writing raw results to persistent memory, logs, or scheduled-job output.
  7. Keep the existing explicit-approval requirement and ensure denial of reconnaissance does not prevent the Skill from providing recommendation-only guidance.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep