Security audit

Openclaw Automation Recipes

Security checks for vulnerabilities and agentic risk

Overview

This recipe-only automation skill is understandable, but several examples can automatically send messages, publish posts, upload data, or store social-media content without built-in safeguards.

Review each recipe before enabling it. Add approval or draft steps for email replies and public posts, limit schedules and keyword matches, verify any S3 bucket and database settings, and avoid backing up or storing sensitive data unless encryption, access controls, and retention are clear.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Indirect Prompt Extraction

Medium

Category: System Prompt Leakage
Content: actions: - type: fetch url: https://news.ycombinator.com/rss - type: summarize prompt: "总结今日科技新闻，列出前 5 条" - type: send to: telegram
Confidence: 75% confidence
Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill documents automatic email replies triggered by keywords, which can send messages on the user's behalf without any warning, confirmation step, rate limit, or scope restriction. This creates a real safety issue because misconfiguration or broad matching could cause unintended outbound communication, reputational harm, or auto-response loops.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The multi-platform publishing recipe automates public posting to several platforms without warning that generated content will be published externally. This is dangerous because users may unintentionally disclose sensitive, inaccurate, or unreviewed content to public audiences across multiple accounts at once.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The backup recipe copies local data from a user directory to remote S3 storage without warning that local files will leave the device and be stored in cloud infrastructure. This is risky because users may back up sensitive data to an unintended bucket, region, or account without understanding confidentiality and retention implications.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The social-media monitoring recipe collects third-party content based on keywords and stores it in a database without warning about data collection, retention, or privacy considerations. This can create compliance and privacy risks if users store personal data, defamatory content, or platform-restricted content without realizing the implications.

Natural-Language Policy Violations

Low

Confidence: 80% confidence
Finding: The file's descriptive and instructional text is entirely in Chinese, and one recipe explicitly generates Chinese output, but there is no indication that the skill is region-specific or that users can choose another language. This may conflict with a language/locale policy requiring user choice or documented justification for a fixed locale.

Static analysis

No suspicious patterns detected.