T08 · Insecure Dependencies
Error
- Location
SKILL.md:28- Finding
Unpinned Remote Repository and Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw配置管理Skill
Security checks for vulnerabilities and agentic risk
Overview
This configuration-management skill is purpose-aligned, but it asks for broad backup, restore, remote sync, scheduling, credential, and sudo-level capabilities without enough safety boundaries or warnings.
Install only if you trust the publisher and repository. Use a private reviewed Git remote, exclude or encrypt secrets before any backup, avoid auto-push until tested, preview restores in a staging directory first, and do not run sudo restore unless you know exactly which files will be changed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 76% confidence
- Finding
The documented Git integration exposes powerful repository and network-affecting operations such as init with arbitrary URLs, push, and pull, but provides no restrictions, validation expectations, or trust-boundary warnings. In a skill that manages configuration, such parameters could direct backups to attacker-controlled repositories or pull untrusted config into an environment, leading to data leakage or unsafe state changes.
- Content
md /config git init --url <repository-url> # 推送更新 /config git push --message "更新说明" # 拉取更新 /config git pull
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash # Git认证 export OPENCLAW_GIT_TOKEN="your-github-token" export OPENCLAW_GIT_SSH_KEY="~/.ssh/id_ed25519" # 加密密钥 export OPENCLAW_ENCRYPTION_KEY="your-encryption-key"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md │ │ └── validation.js # 验证工具 │ └── templates/ # 模板文件 │ ├── openclaw.json.template │ └── secrets.env.template ├── scripts/ # 辅助脚本 │ ├── deploy.sh │ ├── restore.sh
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The security-features section states that the skill automatically desensitizes API keys and supports encrypted storage. Elsewhere, the document only shows manual
/config secrets --encrypt/--decryptusage and includes plaintext examples forOPENCLAW_GIT_TOKENandOPENCLAW_ENCRYPTION_KEY, so the stated automatic protection behavior is not reflected by the documented implementation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation promotes scheduled backup and Git-backed automation without clearly warning that configuration contents may be transmitted to remote repositories or servers. Because configuration often contains secrets, tokens, internal hostnames, or environment-specific data, users may unknowingly exfiltrate sensitive information through auto-push behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The restore workflow is presented as a routine action without warning that it can overwrite existing configuration or operational state. In a configuration-management skill, this can cause destructive misoperation, accidental rollback, outage, or loss of local changes if a user runs restore in the wrong environment.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The documentation instructs users to run a restore command with sudo, which elevates a potentially broad, state-changing operation to full administrative privileges. In the context of a config-restore skill, this increases blast radius substantially: a mistaken restore or compromised package could overwrite privileged files, alter services, or impact the whole host.
- Content
/config fix --permissions
以管理员运行
sudo /config restore --input ./backup.tar.gz
text ### 调试模式
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The natural-language content of the skill documentation is effectively fixed to Chinese, and there is no indication that users may select another language or that the skill is intentionally limited to a Chinese-speaking audience. The policy explicitly calls out forced language or locale without user opt-in as a violation.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
The structure section describes a source tree with specific command and utility modules as if they exist and implement the advertised functionality. In the analyzed file, there is no corresponding code, so the documentation presents an implementation picture that is not supported by the artifact being reviewed.
- Content