OpenClaw安装服务

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:14 PM UTC
• Version: 1.0.0

Overview

The skill is a straightforward OpenClaw setup guide, but users should review the global install, messaging-channel credentials, and heartbeat service before following it.

Before installing, confirm the `openclaw` npm package source, consider pinning or isolating the install, protect any App ID, Secret, webhook, or login session used for channels, and make sure you know how to stop the heartbeat service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:40
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

bash

npm install -g openclaw

Technical Analysis

The skill directs the user or agent to install the latest available version of the openclaw npm package globally. The command does not specify an exact reviewed version, enforce an integrity value, use a lockfile, or require package provenance verification.

npm packages can execute lifecycle scripts during installation. Consequently, a compromised package release, maintainer account, transitive dependency, or package distribution channel could cause arbitrary code to run with the permissions of the account executing the command. Global installation also exposes package-provided executables broadly within that account's environment.

The package name is consistent with the skill's stated purpose, and the reviewed file does not prove that the current package is malicious. The vulnerability is the unsafe and mutable supply-chain installation practice.

Attack Path

1. An attacker compromises the openclaw npm package, its publisher account, or one of its transitive dependencies.
2. The attacker publishes a malicious release or introduces a malicious installation lifecycle script.
3. A user or agent follows the instruction at SKILL.md:40.
4. npm resolves the unpinned dependency to the attacker-controlled release.
5. npm executes applicable lifecycle scripts with the invoking user's permissions.
6. The malicious package can access data available to that user and may subsequently intercept workspace information or Channel credentials entered during OpenClaw configuration.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. The accessible scope may include:

• Files and environment variables readable or writable by the user.
• OpenClaw workspace configuration and operat ...[truncated 438 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an exact version that has undergone security review, for example:

  bash

  npm install -g openclaw@<reviewed-exact-version>
  

• Verify that the package publisher and registry match the project's official distribution information.
• Document and validate package provenance, signatures, or published integrity hashes before installation.
• Review package lifecycle scripts and transitive dependencies before recommending execution.
• Prefer a project-local dependency governed by a committed lockfile over a global installation where operationally possible.
• Consider using a verified standalone release or isolated execution environment with minimal filesystem and credential access.
• Test upgrades separately and update the pinned version only after reviewing the new release and dependency changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to install software globally, initialize a workspace, configure communication channels, and start background heartbeat services, while also advertising remote support, but it does not provide any clear warning that these actions will modify the user's system or may involve granting access or handling credentials. This creates a meaningful safety issue because users may follow commands that alter their environment, persist services, or expose secrets without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instructions, usage examples, pricing, FAQ, and support sections are all written in Chinese, with no indication that other languages are available. This can violate language/locale policy when a skill imposes a language preference without explicit user opt-in or documented regional scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.