ClawSpa

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:54 PM UTC
• Version: 1.4.1

Overview

ClawSpa is a coherent local maintenance skill, but it asks for broad private-agent inspection and includes under-gated persistent scheduling/reporting behavior that users should review before installing.

Install only if you want a local tool that can inspect your agent memory, profile/instruction files, installed skills, scheduler settings, and possible plaintext secrets. Before running it, require confirmation for the exact scan scope, report path, persistent ~/.openclaw/clawspa state, and especially any HEARTBEAT.md weekly schedule; do not enable cloud analysis until you have reviewed the external privacy terms.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:72

Finding

Ungated Recurring Heartbeat Task Creates Cross-Session Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:72-74
Vulnerability Type: Scheduled cross-session execution without an explicit approval gate
Risk Level: High

Vulnerable Code

markdown

## Scheduling

Add to HEARTBEAT.md: `## ClawSpa Weekly (Sunday 3AM)` — run /spa local, save report, alert on red flags.

Technical Analysis

The instruction directs the agent to modify HEARTBEAT.md and register a weekly ClawSpa task. This persistent configuration survives the current invocation and can cause /spa to run during later heartbeat processing without a new user request.

Although SKILL.md:66 generally states that files must not be modified without explicit approval, the scheduling directive does not include an approval requirement and is written as an imperative. This ambiguity can result in the agent applying the persistent change immediately when the Skill is loaded.

The persistence is not required for ClawSpa's primary on-demand maintenance functionality. It therefore exceeds the minimum privileges necessary unless the user separately and explicitly opts into recurring execution.

Attack Path

1. A user invokes ClawSpa for an on-demand maintenance operation.
2. The agent loads and follows SKILL.md.
3. The scheduling instruction causes the agent to add the weekly ClawSpa entry to HEARTBEAT.md.
4. The modified heartbeat configuration persists after the original Skill invocation ends.
5. Future heartbeat processing invokes /spa without a new, contemporaneous user request.
6. Each recurring run may inspect memory, agent instructions, configuration, installed skills, schedules, and usage history, and then write a report.

Impact Assessment

Successful exploitation obtains persistent, recurring execution within the agent's existing heartbeat context. The recurring task can repeatedly exercise the filesystem access already associated with ClawSpa's maintenance procedures, including ...[truncated 411 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the imperative scheduling instruction from the default Skill workflow.
2. Describe recurring scans as an optional feature that is disabled by default.
3. Before modifying HEARTBEAT.md, display the exact proposed entry and request explicit user approval specifically for recurring execution.
4. Separate approval for the current scan from approval for persistent scheduling; approval to run /spa once must not authorize future runs.
5. Validate that an equivalent schedule does not already exist before adding an entry.
6. Document how to inspect, disable, and remove the scheduled task.
7. Record when and why the schedule was installed so its provenance can be audited.
8. Consider requiring confirmation before sensitive scan categories run from an unattended heartbeat.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises a very large set of generic trigger phrases such as 'health check', 'memory cleanup', and 'scan my skills', which can cause accidental invocation in unrelated conversations. Because this skill performs filesystem-oriented maintenance actions and can create reports/persistent state, unintended activation increases the chance of unnecessary sensitive scanning or data persistence without clear user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The setup instructs the agent to create a persistent directory under '~/.openclaw/clawspa/' with config and history storage. Persistent local state can accumulate sensitive operational data, scan results, or metadata across sessions, and broad activation phrases elsewhere in the skill make unintended creation or growth of this state more likely.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

## Setup

On first run, create `~/.openclaw/clawspa/` with `config.md` and `history/`. Optional cloud analysis is documented on clawspa.org, not in the published skill bundle.

## Local Treatments (free)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

## Local Treatments (free)

**🧴 Deep Cleanse** — See `references/deep-cleanse.md` for full procedure. Scans memory files for stale entries, duplicates, and bloat. Never modifies without approval.

**🛡️ Security Scan** — See `references/security-scan.md` for scan procedure and pattern list. Audits installed skills and rates them by risk level.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

## Local Treatments (free)

**🧴 Deep Cleanse** — See `references/deep-cleanse.md` for full procedure. Scans memory files for stale entries, duplicates, and bloat. Never modifies without approval.

**🛡️ Security Scan** — See `references/security-scan.md` for scan procedure and pattern list. Audits installed skills and rates them by risk level.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/alignment-adjustment.md (reported line 67)May include surrounding context.

md

### Should Be a Cron
Find time-based patterns:
- Check daily logs for tasks that appear at regular intervals
- Cross-reference with `crontab -l` output to see if they're already scheduled
- If not scheduled and the pattern is clear, recommend adding to cron

## Step 4: Scan for Stale or Ignored Instructions

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file instructs the skill to check whether plaintext credentials are stored in memory files as part of a health report. While the manifest mentions security scanning generally, this specific health-report procedure extends the wellness/maintenance workflow into secret-discovery behavior, which is not clearly justified by the narrower 'health diagnostics' function described in this file.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · references/health-report.md (reported line 59)May include surrounding context.

md

### 5. Security Hygiene
- Check if `.gitignore` exists and excludes sensitive files
- Check if config files have appropriate permissions (not world-readable)
- Check if any credentials are stored in plaintext in memory files (vs keychain)
- ✅ Good: credentials in keychain, config locked down
- ❌ Bad: plaintext secrets in memory or loose file permissions

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The file switches from an English section to a full Simplified Chinese section, but does not explicitly indicate language selection, localization options, or user preference handling. Under the policy, locale-specific content is acceptable when choice or justification is provided; here, the README includes multiple locales without documenting how users should choose between them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown skill directs the agent to inspect MEMORY.md, user-profile files, and later recent daily memory files, which are likely to contain sensitive user data or private history. The document does not include any user-facing warning about privacy implications or the sensitivity of reviewing personal records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The markdown instructs cross-referencing task patterns with crontab -l, which reveals system scheduling configuration. Although not inherently unsafe, the skill description omits any disclosure that it may inspect host-level automation settings or system integrity-related configuration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The example Use German for de/ch country content imposes a language choice in natural language without offering user opt-in or explaining a compliance or regional requirement. Under the language/locale policy, forcing a specific language without documented justification can be a policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The procedure instructs the agent to create directories and save a report into the workspace without requiring an explicit user-facing confirmation at write time. In an agent environment, silent file writes can surprise users, overwrite expected state, or leave behind sensitive diagnostic artifacts containing memory, configuration, or security details.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.