ClawHub
Back to skill

Security audit

OpenClaw Security Suite

Security checks for vulnerabilities and agentic risk

Overview

This security-review skill is purpose-aligned overall, but it can read any local file path and send the full contents to an LLM without containment or redaction.

Review before installing. Use this only on files and directories you intentionally want an LLM to see, and do not point the review action at secrets, credentials, private agent state, or broad filesystem paths. Treat scan results as advisory, not authoritative, because several advertised security layers are not enforced and the scanner coverage is incomplete.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
index.ts:31
Finding

Unrestricted Local File Disclosure Through AI Review

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
llm/ai_review.ts:3
Finding

Prompt Injection Can Manipulate AI Security Review Results

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scanner/skill_scanner.ts:9
Finding

Non-Recursive and Incomplete File Enumeration Produces False Safe Verdicts

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scanner/ast_scanner.ts:17
Finding

AST and Keyword Rules Are Trivially Bypassable

Content
View full analysis
) { const moduleName = path.node.source.value if (policy.blocked_modules.includes(moduleName)) { issues.push({ type: "blocked_module", module: moduleName }) } }, CallExpression(path: NodePath) { const callee = path.node.callee const name = callee.type === "Identifier" ? callee.name : undefined if (name && policy.blocked_functions.includes(name)) { issues.push({ type: "blocked_function", function: name }) } } }) ``` The relevant policy only performs exact-name matching: ```json { "blocked_modules": [ "child_process", "cluster" ], "blocked_functions": [ "exec", "spawn", "execSync" ] } ``` ### Technical Analysis Blocked modules are detected only when they appear in static `ImportDeclaration` nodes with an exact module string. This misses, among other variants: - `node:child_process` - CommonJS `require(...)` - Dynamic `import(...)` - Indirectly constructed module names Dangerous function calls are detected only when the callee is a direct `Identifier`. Member calls, aliases, computed properties, and simple data-flow transformations are not resolved. The keyword scanner provides only literal substring and regular-expression matching. Such checks are case- and formatting-sensitive and can be bypassed by whitespace, comments, string concatenation, computed properties, alternate import syntax, or aliases. ### Attack Path 1. An attacker imports a blocked module using a form not represented by the exact policy string, su ...[truncated 894 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:59
Finding

Advertised Runtime, Signature, and Permission Protections Are Not Enforced

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description emphasizes security analysis capabilities: static scanning via AST/keywords and AI-powered semantic review for malicious behavior detection. The supplied code does not implement scanning, analysis, AST inspection, keyword matching, or AI review. Instead, it creates an isolated VM context and executes arbitrary code with a timeout. That is a materially different primary purpose and an undeclared capability. While a sandbox runner could be a supporting component of a larger security suite, this chunk by itself is code execution infrastructure, not security scanning behavior as described.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description says this skill is a comprehensive security analysis suite focused on static scanning and semantic review of code for malicious behavior. The supplied code does not implement scanning or behavior analysis. Instead, it performs a narrow cryptographic task: reading a file and verifying a provided signature against a public key. This is a materially different primary purpose from the declared one, so the description does not accurately represent the actual behavior of the code chunk.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
- **Dangerous Functions**: e.g., `exec()`, `spawn()`
- **Known Bad Keywords**: e.g., `eval(`, `__proto__`, `rm -rf`
- **Sensitive File Access**: e.g., `/etc/passwd`, `/.env`
- **Suspicious Regex Patterns**: e.g., `curl ... | bash`

### 2. AI Code Review (`action: "review"`)
Uses the active LLM context (`ctx.llm`) to semantically analyze a specific file for hidden threats:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · config/malicious_patterns.json (reported line 30)May include surrounding context.

json
"\"nc ",
        "\"netcat ",
        "\"ssh ",
        "chmod 777"
    ],
    "sensitive_files": [
        "/etc/passwd",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
"chmod 777"
    ],
    "sensitive_files": [
        "/etc/passwd",
        "/etc/shadow",
        "/.ssh",
        "/.env"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/malicious_patterns.json (reported line 33)May include surrounding context.

json
"chmod 777"
    ],
    "sensitive_files": [
        "/etc/passwd",
        "/etc/shadow",
        "/.ssh",
        "/.env"

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/malicious_patterns.json (reported line 34)May include surrounding context.

json
],
    "sensitive_files": [
        "/etc/passwd",
        "/etc/shadow",
        "/.ssh",
        "/.env"
    ],

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/malicious_patterns.json (reported line 36)May include surrounding context.

json
"/etc/passwd",
        "/etc/shadow",
        "/.ssh",
        "/.env"
    ],
    "suspicious_urls": [
        "metadata.google.internal",

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
90% confidence
Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · config/malicious_patterns.json (reported line 39)May include surrounding context.

json
"/.env"
    ],
    "suspicious_urls": [
        "metadata.google.internal",
        "169.254.169.254"
    ],
    "suspicious_patterns": [

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
90% confidence
Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

md
],
    "suspicious_urls": [
        "metadata.google.internal",
        "169.254.169.254"
    ],
    "suspicious_patterns": [
        "curl .+\\|.+bash",

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
90% confidence
Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · config/malicious_patterns.json (reported line 40)May include surrounding context.

json
],
    "suspicious_urls": [
        "metadata.google.internal",
        "169.254.169.254"
    ],
    "suspicious_patterns": [
        "curl .+\\|.+bash",

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · config/malicious_patterns.json (reported line 30)May include surrounding context.

json
"\"nc ",
        "\"netcat ",
        "\"ssh ",
        "chmod 777"
    ],
    "sensitive_files": [
        "/etc/passwd",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The review action reads whatever file path is supplied, loads the full file contents into memory, and forwards that content to aiReview(code, ctx.llm). If an attacker or untrusted caller can influence targetPath, this can exfiltrate sensitive local files, source code, secrets, or proprietary data to an external LLM service without any path restrictions, consent checks, or redaction.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json
"publish:skill": "./scripts/publish.sh"
    },
    "dependencies": {
        "@babel/parser": "^7.26.0",
        "@babel/traverse": "^7.26.0"
    },
    "devDependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json
},
    "dependencies": {
        "@babel/parser": "^7.26.0",
        "@babel/traverse": "^7.26.0"
    },
    "devDependencies": {
        "@types/babel__traverse": "^7.28.0",

Unverifiable Dependency: @babel/traverse has 1 known advisory(ies) (CVE-2023-45133 (Babel vulnerable to arbitrary code execution when compiling specifically crafted)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
82% confidence
Finding

The manifest references @babel/traverse with a non-exact version while that package has a known advisory history, making it impossible from this file alone to verify whether installs resolve to a safe release. In a security-scanning skill that parses and semantically reviews potentially adversarial code, using a parser/traversal library with uncertain patch status increases supply-chain and code-processing risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json
"@babel/traverse": "^7.26.0"
    },
    "devDependencies": {
        "@types/babel__traverse": "^7.28.0",
        "@types/node": "^22.0.0",
        "typescript": "^5.6.0"
    }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json
},
    "devDependencies": {
        "@types/babel__traverse": "^7.28.0",
        "@types/node": "^22.0.0",
        "typescript": "^5.6.0"
    }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"devDependencies": {
        "@types/babel__traverse": "^7.28.0",
        "@types/node": "^22.0.0",
        "typescript": "^5.6.0"
    }
}