ClawHub
Back to skill

Security audit

Claw Security Self-Check

Security checks for vulnerabilities and agentic risk

Overview

The skill is a read-only OpenClaw security-audit tool with no evidence of hidden remediation, exfiltration, or persistence, but users should handle reports and installation provenance carefully.

Install only from a reviewed pinned revision or ClawHub-reviewed package, run baseline mode only on the OpenClaw host you intend to assess, expect read-only local commands and npm provenance network checks, and store generated reports as internal security material. Use report-only mode only with trusted baseline/manual-review JSON, or view generated Markdown in a renderer that disables raw HTML and remote resource loading.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:23
Finding

Unpinned Installation from a Mutable GitHub Repository

Content
View full analysis
Install the `claw-security-self-check` Skill from the [Xiaoyiyi23/claw-security-self-check](https://github.com/Xiaoyiyi23/claw-security-self-check) GitHub repository. After installation, confirm that Node.js and the `openclaw` CLI are available, and tell me the Skill installation directory and whether it can be invoked with `$claw-security-self-check`. The Agent will install the repository into a Skill directory recognized by the current OpenClaw environment. ``` ### Technical Analysis The installation instructions identify a GitHub repository but do not pin the installation to a reviewed commit hash, signed release, immutable tag, or expected artifact digest. Consequently, the content installed by an Agent can differ from the version that was security-reviewed. This creates a time-of-check/time-of-use supply-chain weakness. An attacker who compromises the repository, its default branch, a maintainer account, or the installation resolution process could replace the Skill instructions or scripts after this audit. The next installation would then consume the changed content without an integrity check. The audited snapshot itself contains no malicious dependency or remote payload execution. The risk arises from the mutable installation source. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another mechanism capable of changing the default branch. 2. The attacker modifies `SKILL.md`, Agent instructions, or scripts such as `host-baseline.mjs`. 3. A user follows the documented instruction to install directly from the repository without selecting an immutable revision. 4. The Agent installs and activates the attacker-contr ...[truncated 782 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/report-merge.mjs:429
Finding

Markdown Injection Through Insufficiently Constrained Baseline Fields

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/host-baseline.mjs (reported line 1265)May include surrounding context.

js
checkOptionalPathPermissions(
    checks,
    "OpenClaw-2-2",
    "State-directory .env",
    path.join(options.stateDir, ".env"),
    "file",
    0o600,

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/host-baseline.mjs (reported line 1266)May include surrounding context.

js
checkOptionalPathPermissions(
    checks,
    "OpenClaw-2-2",
    "State-directory .env",
    path.join(options.stateDir, ".env"),
    "file",
    0o600,

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 94)May include surrounding context.

md
## Report Statuses

| Status           | Meaning                                                                                   |
| ---------------- | ----------------------------------------------------------------------------------------- |
| `PASS`           | The required read-only evidence was collected and the configuration or runtime state complies with the check |
| `WARN`           | Evidence is available, but the configuration is weak, contains exceptions, or requires manual review         |

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes local scripts and the OpenClaw CLI to inspect host configuration and produce reports, but it does not declare an explicit tool scope such as allowed tools or permissions. In a host-assessment skill, that omission weakens containment and reviewability because an agent may be granted broader environment or network access than the workflow actually requires.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest frames the skill as a strict read-only security assessment and report generation utility, but this implementation obtains evidence by executing many host commands including openclaw, ss, ps, npm, and PowerShell with inline scripts. While some host interrogation is relevant to assessment, the breadth of subprocess execution is a materially stronger capability than a simple report-generation or JSON-merging tool would imply and should be explicitly declared.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill metadata emphasizes a strict read-only/offline assessment capability, but this script performs live HTTPS requests to the configured npm registry and attestation endpoints to verify package provenance. That mismatch expands the operational capability beyond what a user may reasonably expect, creating unintended network egress and weakening trust boundaries for a security-audit skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code performs outbound requests to the npm registry, key endpoint, and attestation URL without any explicit user disclosure at the point of operation. For a security self-check skill advertised as read-only/offline-capable, undisclosed network egress is risky because it can leak package/version usage, environment behavior, and violate user expectations or restricted-host policies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script writes a JSON report to an arbitrary user-supplied path when --output is set, but it does so without any explicit warning that the report may contain sensitive host configuration, paths, usernames, findings, and security posture details. In a security-audit context, silent persistence of such data can create secondary exposure if written to shared, synced, or less-protected locations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README states that report-only mode generates 'English-language Markdown reports,' which imposes a specific language requirement. Later text reinforces that user-facing explanations and headings remain in English, but there is no user opt-in or documented regional/compliance justification for this locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file says that user-facing explanations, headings, and operating instructions in the generated report are written in English. This is a natural-language policy concern because it forces a locale choice on users without indicating that they can select another language or consent to the restriction.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
80% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
- `PASS` means that observable effective configuration and runtime state meet the check requirements. It does not mean that penetration testing was performed.
- Do not validate controls through real anonymous requests, unauthorized reads, directory traversal, commands outside an allowlist, or fake-secret writes.
- Do not create test Agents, change production Agent policies, or temporarily elevate privileges.
- Do not read real SSH keys, cloud metadata, databases, user documents, private messages, or production secrets.
- Public network reachability, real unauthorized third-party IM accounts, and remote SIEM delivery are out of scope.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
80% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · references/check-matrix.md (reported line 26)May include surrounding context.

md
- `PASS` means that observable effective configuration and runtime state meet the check requirements. It does not mean that penetration testing was performed.
- Do not validate controls through real anonymous requests, unauthorized reads, directory traversal, commands outside an allowlist, or fake-secret writes.
- Do not create test Agents, change production Agent policies, or temporarily elevate privileges.
- Do not read real SSH keys, cloud metadata, databases, user documents, private messages, or production secrets.
- Public network reachability, real unauthorized third-party IM accounts, and remote SIEM delivery are out of scope.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The description says the skill can also generate reports offline from existing baseline JSON and manual-review JSON files. This script's main flow does not consume existing JSON artifacts; instead it invokes the OpenClaw CLI, system utilities, and package provenance retrieval to build a fresh baseline report, so the documented offline-report capability is not represented by this file's actual behavior.

Content

No source excerpt is available for this finding.