OpenClaw配置管理Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:32 AM UTC
• Version: 0.0.1

Overview

This configuration-management skill is purpose-aligned, but it asks for broad backup, restore, remote sync, scheduling, credential, and sudo-level capabilities without enough safety boundaries or warnings.

Install only if you trust the publisher and repository. Use a private reviewed Git remote, exclude or encrypt secrets before any backup, avoid auto-push until tested, preview restores in a staging directory first, and do not run sudo restore unless you know exactly which files will be changed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:28
• Finding: Unpinned Remote Repository and Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 28–38 **Vulnerability Type**: Unverified remote source and dependency-chain execution **Risk Level**: High ### Vulnerable Code ```bash ### 方式一：从ClawHub安装 clawhub install openclaw-config-manager ``` ```bash # 克隆仓库 git clone https://github.com/wisdom-wozoy/openclaw-config-manager.git # 安装依赖 cd openclaw-config-manager npm install # 注册Skill openclaw skills register ./openclaw-config-manager ``` ### Technical Analysis The installation procedure retrieves a mutable remote repository without pinning a reviewed commit, validating a cryptographic checksum, or verifying a signed release. It then executes `npm install`, which can run package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Those scripts, along with the remotely retrieved Skill implementation and dependencies, are absent from the audited artifact and therefore cannot be verified. Because the repository reference is not immutable, the code installed by a user may differ from the code available at audit time. A compromised repository, malicious future revision, dependency compromise, or unsafe package update could consequently introduce arbitrary local code execution. The alternative `clawhub install` command similarly does not identify a pinned version or integrity-verification mechanism in the provided documentation. ### Attack Path 1. An attacker compromises the referenced GitHub repository, its maintainer account, the distribution channel, or an npm dependency. 2. The attacker adds malicious Skill code or a package lifecycle script to the remotely retrieved content. 3. A user follows the documented installation procedure without verifying a commit, signature, or checksum. 4. `npm install` processes the attacker-controlled package metadata and may execute malicious lifecycle scripts with the user's privileges. 5. The user registers the resulting Skill through `openclaw skills register`. 6. The malicious ...[truncated 743 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin installation instructions to a specific, reviewed commit hash or immutable release version. 2. Publish cryptographic checksums for release artifacts and require users to verify them before installation. 3. Sign releases and document signature verification using a trusted maintainer key. 4. Include and review the complete implementation, `package.json`, lockfile, and required lifecycle scripts in the distributed Skill artifact. 5. Use `npm ci` with a committed lockfile rather than unconstrained `npm install`. 6. Use `npm ci --ignore-scripts` when lifecycle scripts are not strictly required. If scripts are required, document and audit each one. 7. Pin dependencies to reviewed versions and enable automated dependency integrity and vulnerability checks. 8. Install and test the Skill under a dedicated, least-privileged account or isolated environment. 9. Document an explicit ClawHub version and its integrity-verification process rather than relying on an unspecified latest release. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

/config git init --url <repository-url>

# 推送更新
/config git push --message "更新说明"

# 拉取更新
/config git pull

• Confidence: 76% confidence
• Finding: The documented Git integration exposes powerful repository and network-affecting operations such as init with arbitrary URLs, push, and pull, but provides no restrictions, validation expectations, or trust-boundary warnings. In a skill that manages configuration, such parameters could direct backups to attacker-controlled repositories or pull untrusted config into an environment, leading to data leakage or unsafe state changes.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# Git认证
export OPENCLAW_GIT_TOKEN="your-github-token"
export OPENCLAW_GIT_SSH_KEY="~/.ssh/id_ed25519"

# 加密密钥
export OPENCLAW_ENCRYPTION_KEY="your-encryption-key"

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

│   │   └── validation.js    # 验证工具
│   └── templates/            # 模板文件
│       ├── openclaw.json.template
│       └── secrets.env.template
├── scripts/                  # 辅助脚本
│   ├── deploy.sh
│   ├── restore.sh

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The security-features section states that the skill automatically desensitizes API keys and supports encrypted storage. Elsewhere, the document only shows manual `/config secrets --encrypt/--decrypt` usage and includes plaintext examples for `OPENCLAW_GIT_TOKEN` and `OPENCLAW_ENCRYPTION_KEY`, so the stated automatic protection behavior is not reflected by the documented implementation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation promotes scheduled backup and Git-backed automation without clearly warning that configuration contents may be transmitted to remote repositories or servers. Because configuration often contains secrets, tokens, internal hostnames, or environment-specific data, users may unknowingly exfiltrate sensitive information through auto-push behavior.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The restore workflow is presented as a routine action without warning that it can overwrite existing configuration or operational state. In a configuration-management skill, this can cause destructive misoperation, accidental rollback, outage, or loss of local changes if a user runs restore in the wrong environment.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

/config fix --permissions

# 以管理员运行
sudo /config restore --input ./backup.tar.gz
```

### 调试模式

• Confidence: 84% confidence
• Finding: The documentation instructs users to run a restore command with sudo, which elevates a potentially broad, state-changing operation to full administrative privileges. In the context of a config-restore skill, this increases blast radius substantially: a mistaken restore or compromised package could overwrite privileged files, alter services, or impact the whole host.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The natural-language content of the skill documentation is effectively fixed to Chinese, and there is no indication that users may select another language or that the skill is intentionally limited to a Chinese-speaking audience. The policy explicitly calls out forced language or locale without user opt-in as a violation.

Intent-Code Divergence

Low

• Confidence: 75% confidence
• Finding: The structure section describes a source tree with specific command and utility modules as if they exist and implement the advertised functionality. In the analyzed file, there is no corresponding code, so the documentation presents an implementation picture that is not supported by the artifact being reviewed.

Static analysis

No suspicious patterns detected.