Openclaw Cn Installer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:07 AM UTC
• Version: 1.0.1

Overview

The skill matches its stated OpenClaw setup purpose, but users should understand it stores provider API keys locally and uses a mutable installer command.

Install only if you are comfortable with a Chinese-language OpenClaw helper that stores DeepSeek, Zhipu, or DashScope API keys in ~/.openclaw/.env and uses those keys to make test requests to the providers. Prefer a pinned installer version when available, and restrict ~/.openclaw/.env permissions to your user account.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27
• Finding: Unpinned Remote Package Execution Through npx## Vulnerability Details **File Location**: `SKILL.md:27-29` **Vulnerability Type**: Supply-chain exposure through mutable package resolution **Risk Level**: Medium ```bash npx clawhub@latest install openclaw-cn-installer ``` ### Technical Analysis The documented installation command instructs users to download and execute the package currently associated with the mutable `latest` tag. The effective code executed by `npx` can therefore change after this Skill has been reviewed. No malicious dependency is present in the audited project itself. However, the command creates a supply-chain execution boundary: compromise of the registry account, package publication process, registry resolution, or a future release could cause users to execute unaudited code. The package runs with the privileges of the user invoking `npx`. ### Attack Path 1. An attacker compromises the publisher account, release pipeline, or package associated with `clawhub`. 2. The attacker publishes a malicious version and assigns it the `latest` distribution tag. 3. A user follows the installation command in `SKILL.md`. 4. `npx` retrieves and executes the attacker-controlled package. 5. The malicious package can access files, credentials, network resources, and processes available to the invoking user. ### Impact Assessment Successful exploitation permits arbitrary code execution under the invoking user's account. This could expose OpenClaw configuration, API keys, source code, SSH credentials, and other user-readable data. It could also modify user-owned files or establish user-level persistence. The command does not inherently grant administrator or root privileges, so the immediate scope is limited to the invoking user's permissions.
• Remediation: ## Remediation Suggestions - Replace the mutable `latest` tag with an exact, reviewed package version. - Publish and document a cryptographic checksum or other verifiable provenance information for the expected installer. - Use a lockfile or similarly reproducible installation mechanism where supported. - Restrict installation to the expected registry and verify the package publisher and repository before execution. - Recommend running the installer as an unprivileged user and reviewing downloaded code before execution in sensitive environments.

T09 · Insecure Skill Coding Practices

Warning

• Location: setup-ai.js:60
• Finding: API Keys Written Without Enforced Restrictive File Permissions## Vulnerability Details **File Location**: `setup-ai.js:60-64` **Vulnerability Type**: Insecure storage permissions for API credentials **Risk Level**: Medium ```js function saveEnv(env) { const content = Object.entries(env) .map(([k, v]) => `${k}=${v}`) .join('\n'); fs.writeFileSync(envFile, content + '\n'); ``` ### Technical Analysis The Skill legitimately requires API credentials to configure the declared AI providers, and reading and writing `~/.openclaw/.env` is consistent with that functionality. However, `fs.writeFileSync` is called without specifying a restrictive file mode. For a newly created file, its permissions depend on the process umask. In environments with permissive defaults, the credential file may be readable by other local users. When the file already exists, the operation does not correct excessively broad permissions. The file contains bearer-style API keys for DeepSeek, Zhipu, or DashScope, so possession of the stored value can be sufficient to use the associated account. ### Attack Path 1. A user runs `setup-ai.js` and enters an API key. 2. The Skill writes the key to `~/.openclaw/.env` using ambient or existing file permissions. 3. The resulting file is readable by another local account or a process operating outside the intended trust boundary. 4. The attacker copies a provider API key from the file. 5. The attacker submits authenticated requests to the corresponding AI provider using the stolen credential. ### Impact Assessment Exploitation can result in unauthorized API usage, consumption of paid quota, unexpected charges, provider-side data exposure within the permissions of the key, and suspension of the affected account. This flaw does not itself grant operating-system privilege escalation. Its scope is limited to credentials stored in the environment file and the permissions granted to those credentials by their providers.
• Remediation: ## Remediation Suggestions - Create the credential file with owner-only permissions: ```js fs.writeFileSync(envFile, content + '\n', { mode: 0o600 }); ``` - Explicitly apply `fs.chmodSync(envFile, 0o600)` after writing so that insecure permissions on an existing file are corrected. - Ensure `~/.openclaw` is accessible only to the owning user, preferably with mode `0o700`. - Write updates atomically through a temporary file created with mode `0o600`, then rename it into place. - Where available, prefer an operating-system credential store or dedicated secret manager instead of a plaintext environment file. - Avoid logging credential values and document recommended key rotation if file exposure is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior claims one-click configuration of multiple AI providers, but the described implementation evidence does not substantiate those capabilities. This mismatch is dangerous because users may grant trust, execute scripts, or expose configuration secrets under false assumptions about what the skill actually does.

Credential Access

High

• Category: Privilege Escalation

Content

### Q: OpenClaw 配置文件在哪？
```
~/.openclaw/config.json       # 主配置
~/.openclaw/.env              # 环境变量（API Keys）
~/.openclaw/workspace/        # 工作目录
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

const readline = require('readline');

const openclawDir = path.join(os.homedir(), '.openclaw');
const envFile = path.join(openclawDir, '.env');
const configFile = path.join(openclawDir, 'config.json');

const MODELS = {

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

const readline = require('readline');

const openclawDir = path.join(os.homedir(), '.openclaw');
const envFile = path.join(openclawDir, '.env');
const configFile = path.join(openclawDir, 'config.json');

const MODELS = {

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

return false;
    }

    // 保存到 .env
    const env = loadEnv();
    env[model.envKey] = apiKey;
    saveEnv(env);

• Confidence: 84% confidence
• Finding: This code writes a sensitive API key into a .env file in the user's home directory, creating a local credential exposure risk if file permissions are weak or the system is compromised. In an installer/setup skill, credential collection is contextually expected, which makes the behavior less suspicious than malware, but plaintext persistence of secrets still increases attack surface.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents shell-based execution steps but does not declare any explicit tool scope or permissions. This weakens reviewability and least-privilege controls, making it easier for a user or platform to invoke shell-capable behavior without clear upfront consent boundaries.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The manifest description and title explicitly position the skill as being for Chinese users only ("适合中国用户" / "专为中文用户设计") without indicating that other languages are available or that the locale is optional. This is a natural-language locale policy concern because the skill appears to force a specific language/locale rather than offering user choice.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: Using `npx clawhub@latest install openclaw-cn-installer` pulls and executes the latest package version at install time, which is a supply-chain risk. If the upstream package is compromised or a malicious release is published, users may execute attacker-controlled code immediately during installation.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The user-facing strings throughout the script, including the main banner, status labels, recommendations, and suggested next steps, are all presented in Chinese. This enforces a specific language for all users without opt-in or explanation, which matches the language/locale policy violation category.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: User-facing help, prompts, and status messages are written in Chinese and the header explicitly labels the installer as a CN setup flow. This imposes a language choice without any opt-in or alternative locale, which matches the language/locale policy concern.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script prompts for an API key and writes it directly to a local .env file without clearly warning the user that the credential will be stored in plaintext on disk. While this is common in developer tooling, plaintext local storage increases exposure if the home directory is shared, backed up insecurely, or readable by other local processes/users.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code reads credential material from ~/.openclaw/.env and later uses it in outbound HTTPS requests to third-party AI endpoints. While the script's purpose is connection testing, there is no explicit disclosure to the user in the code that running it will send authentication data and a test prompt to external services.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The package description explicitly presents the skill as a Chinese-language assistant ("中文安装配置助手") without indicating any user choice of language or locale. Under the policy rules, forcing a specific language without opt-in is a natural-language locale-policy concern.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The file includes comments and console output in Chinese throughout, and the runtime messages shown to users are not localized or configurable. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: check-env.js:50