Aegis4All

• Outcome: Review
• Latest audit: Sep 4, 2026 · 3:09 PM UTC
• Version: 4.0.1

Overview

This appears to be a defensive OpenClaw hardening skill, but it needs review because some high-impact fixes are labeled inconsistently as safe or executable.

Review the high-impact sections before installing. The skill is defensive, but do not let it automatically rotate Gateway tokens, change communication access, move API keys, or persist rules into agent memory unless you understand the exact diff and have a rollback path.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (23)

Credential Access

High

• Category: Privilege Escalation

Content

---

## Guide 3: Move API keys to a .env file
**Assessment: EXECUTABLE**

**Why:** Keys stored in the main JSON config are visible to any tool that reads the config. A `.env` file is loaded as environment variables and is easier to exclude from backups and version control.

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---

## Guide 3: Move API keys to a .env file
**Assessment: EXECUTABLE**

**Why:** Keys stored in the main JSON config are visible to any tool that reads the config. A `.env` file is loaded as environment variables and is easier to exclude from backups and version control.

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---

## Guide 3: Move API keys to a .env file
**Assessment: EXECUTABLE**

**Why:** Keys stored in the main JSON config are visible to any tool that reads the config. A `.env` file is loaded as environment variables and is easier to exclude from backups and version control.

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match

Content

tch for reported issues.
5. After updating, re-run `safe check` to confirm nothing regressed.

---

## Guide 6: Lock down DM and group access
**Assessment: EXECUTABLE**

**Why:** Open DMs and open groups are the most direct way for strangers to reach the agent. The official threat model lists identity control as the first priority. Locking down who can talk to the bot removes the largest share of social-engineering and prompt-injection risk.

**Steps:**
1. **Enable DM pairing.** In `openclaw.json`, find the channel's `dmPolicy` and set it to `"pairing"` (or `"allowlist"` if the channel supports it). Non-technical explanation: strangers now need a pairing code or an entry on your allowlist before the agent will respond to them.
2. **Restrict group access.** For each group channel, set `groupAllowFrom` to your own user IDs and enable `requireMention`. Explanation: the agent now responds in groups only when an allowed member explicitly mentions it.
3. **Disable node auto-pairing.** Find `

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Credential Access

High

• Category: Privilege Escalation

Content

- Never paste API keys, tokens, or passwords into chat messages.
- Never write credentials into AGENTS.md, TOOLS.md, memory files, or daily notes.
- Mask sensitive values in logs and outputs (show first 4 characters only).
- Keep `.gitignore` covering `.env`, `*.key`, `*.pem`, `credentials.json`, and `secrets.*`.

## Rule block 7: Prepay Breaker (PB)
- Use prepaid credits with monthly hard limits; avoid pay-as-you-go with no cap.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Never paste API keys, tokens, or passwords into chat messages.
- Never write credentials into AGENTS.md, TOOLS.md, memory files, or daily notes.
- Mask sensitive values in logs and outputs (show first 4 characters only).
- Keep `.gitignore` covering `.env`, `*.key`, `*.pem`, `credentials.json`, and `secrets.*`.

## Rule block 7: Prepay Breaker (PB)
- Use prepaid credits with monthly hard limits; avoid pay-as-you-go with no cap.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

Aegis4All v4.1
```

**Output rule:** The entire guide index is ONE message. Never split. Never output guides one by one unless user asks for a specific number.

### Which guides the agent CAN vs CANNOT execute

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The file describes rules to be injected when the user approves `inject rules`, but it does not tightly constrain the trigger conditions, scope, or validation for that operation. Broad invocation language in an instruction-injection file can increase the chance of accidental or inappropriate modification of AGENTS.md and TOOLS.md, especially in systems that process natural language commands.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Keep the Gateway bound to `loopback` unless a firewall rule is explicitly configured.
- Keep DM policy on `pairing` or `allowlist`; never `open`.
- Restrict group access: use allowlists and mention gating (`requireMention`), never open groups without gating.
- Keep `gateway.nodes.pairing.autoApproveCidrs` empty; never auto-approve node pairing.
- Do not allow `system.run` on paired nodes without an explicit allow/deny list.
- Deny control-plane tools (`gateway`, `cron`, `sessions_spawn`, `sessions_send`) for any agent that processes untrusted content.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Keep the Gateway bound to `loopback` unless a firewall rule is explicitly configured.
- Keep DM policy on `pairing` or `allowlist`; never `open`.
- Restrict group access: use allowlists and mention gating (`requireMention`), never open groups without gating.
- Keep `gateway.nodes.pairing.autoApproveCidrs` empty; never auto-approve node pairing.
- Do not allow `system.run` on paired nodes without an explicit allow/deny list.
- Deny control-plane tools (`gateway`, `cron`, `sessions_spawn`, `sessions_send`) for any agent that processes untrusted content.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Keep the Gateway bound to `loopback` unless a firewall rule is explicitly configured.
- Keep DM policy on `pairing` or `allowlist`; never `open`.
- Restrict group access: use allowlists and mention gating (`requireMention`), never open groups without gating.
- Keep `gateway.nodes.pairing.autoApproveCidrs` empty; never auto-approve node pairing.
- Do not allow `system.run` on paired nodes without an explicit allow/deny list.
- Deny control-plane tools (`gateway`, `cron`, `sessions_spawn`, `sessions_send`) for any agent that processes untrusted content.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Keep the Gateway bound to `loopback` unless a firewall rule is explicitly configured.
- Keep DM policy on `pairing` or `allowlist`; never `open`.
- Restrict group access: use allowlists and mention gating (`requireMention`), never open groups without gating.
- Keep `gateway.nodes.pairing.autoApproveCidrs` empty; never auto-approve node pairing.
- Do not allow `system.run` on paired nodes without an explicit allow/deny list.
- Deny control-plane tools (`gateway`, `cron`, `sessions_spawn`, `sessions_send`) for any agent that processes untrusted content.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Keep the Gateway bound to `loopback` unless a firewall rule is explicitly configured.
- Keep DM policy on `pairing` or `allowlist`; never `open`.
- Restrict group access: use allowlists and mention gating (`requireMention`), never open groups without gating.
- Keep `gateway.nodes.pairing.autoApproveCidrs` empty; never auto-approve node pairing.
- Do not allow `system.run` on paired nodes without an explicit allow/deny list.
- Deny control-plane tools (`gateway`, `cron`, `sessions_spawn`, `sessions_send`) for any agent that processes untrusted content.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Keep the Gateway bound to `loopback` unless a firewall rule is explicitly configured.
- Keep DM policy on `pairing` or `allowlist`; never `open`.
- Restrict group access: use allowlists and mention gating (`requireMention`), never open groups without gating.
- Keep `gateway.nodes.pairing.autoApproveCidrs` empty; never auto-approve node pairing.
- Do not allow `system.run` on paired nodes without an explicit allow/deny list.
- Deny control-plane tools (`gateway`, `cron`, `sessions_spawn`, `sessions_send`) for any agent that processes untrusted content.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Keep the Gateway bound to `loopback` unless a firewall rule is explicitly configured.
- Keep DM policy on `pairing` or `allowlist`; never `open`.
- Restrict group access: use allowlists and mention gating (`requireMention`), never open groups without gating.
- Keep `gateway.nodes.pairing.autoApproveCidrs` empty; never auto-approve node pairing.
- Do not allow `system.run` on paired nodes without an explicit allow/deny list.
- Deny control-plane tools (`gateway`, `cron`, `sessions_spawn`, `sessions_send`) for any agent that processes untrusted content.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Keep the Gateway bound to `loopback` unless a firewall rule is explicitly configured.
- Keep DM policy on `pairing` or `allowlist`; never `open`.
- Restrict group access: use allowlists and mention gating (`requireMention`), never open groups without gating.
- Keep `gateway.nodes.pairing.autoApproveCidrs` empty; never auto-approve node pairing.
- Do not allow `system.run` on paired nodes without an explicit allow/deny list.
- Deny control-plane tools (`gateway`, `cron`, `sessions_spawn`, `sessions_send`) for any agent that processes untrusted content.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Keep the Gateway bound to `loopback` unless a firewall rule is explicitly configured.
- Keep DM policy on `pairing` or `allowlist`; never `open`.
- Restrict group access: use allowlists and mention gating (`requireMention`), never open groups without gating.
- Keep `gateway.nodes.pairing.autoApproveCidrs` empty; never auto-approve node pairing.
- Do not allow `system.run` on paired nodes without an explicit allow/deny list.
- Deny control-plane tools (`gateway`, `cron`, `sessions_spawn`, `sessions_send`) for any agent that processes untrusted content.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Rule block 5: Backup and Confirmation (BC)
- Before any destructive action (delete, overwrite, uninstall, migration), create a backup of the affected files or data.
- Require explicit confirmation for destructive operations; never auto-confirm.
- Prefer recoverable operations (move to trash) over permanent deletion.

## Rule block 6: Credential Guard (CG)

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The rule explicitly directs operators to store secrets in a global `.env` file, which is a risky credential-handling pattern because it centralizes sensitive data in a file-based location that may be broadly readable, copied, or accidentally exposed. In a document presented as a security guardrail, this guidance can normalize insecure secret storage and weaken overall credential hygiene.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The skill gives conflicting safety guidance: the guide index says Guide 2 is executable/safe, while the repair rules explicitly forbid automatic changes to bind/auth token because they may disconnect or lock out the agent. In practice, this inconsistency can cause an orchestrator or downstream agent to take unsafe remediation actions based on the more permissive instruction.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The guide index labels Guide 3 and Guide 6 as executable/safe, but the defense mapping classifies those actions as advisory or conditional because they can break model access or lock the agent out of user communication. This mismatch weakens guardrails and can lead to unsafe automatic edits when a consumer trusts the guide index over the stricter rules.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The instruction says guide content must use the original language and must not be translated. This imposes a language choice on the user without offering an opt-in or alternative, which is a natural-language locale policy issue under SQP-3.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The instruction 'Store secrets in a global `.env` file' imposes a fixed operational policy in natural language without stating scope, exceptions, or user opt-in. While not a language setting, it is an organizational instruction embedded as a blanket rule and may conflict with environment-specific policies if applied universally.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: guides/security-guide.md:28