Openclaw Troubleshoot Cn

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:24 AM UTC
• Version: 1.0.1

Overview

This is a coherent Chinese OpenClaw troubleshooting guide, but it includes high-impact repair commands without enough safeguards.

Review before installing. The skill is not deceptive or self-executing, but users should avoid blindly running the sudo ownership changes, persistent npm registry change, kill -9, and OpenClaw reset commands. Prefer user-scoped Node/npm fixes, temporary registry overrides, environment variables for secrets, verified backups, and explicit rollback steps before using the higher-impact commands.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:41
• Finding: Persistent Redirection of npm to a Third-Party Package Registry<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 41 **Vulnerability Type**: Supply-chain trust boundary expansion through an unsafe dependency source **Risk Level**: Medium ### Vulnerable Code ```bash npm config set registry https://registry.npmmirror.com ``` ### Technical Analysis The command persistently changes npm's configured registry from the official npm registry to a third-party mirror. This setting affects subsequent npm operations beyond the immediate troubleshooting session and is not automatically reverted. Although the referenced mirror is not proven to be malicious, using a third-party package source expands the dependency supply-chain trust boundary. If the mirror is compromised, serves inconsistent content, or does not enforce the same package-integrity controls as the official registry, future package installations could retrieve stale, substituted, or malicious package artifacts. npm packages may execute lifecycle scripts during installation, so a compromised dependency can result in local code execution under the privileges of the user running npm. The documentation neither explains this persistent effect nor provides package pinning, integrity verification, or a command to restore the official registry. ### Attack Path 1. A user follows the network-timeout troubleshooting instruction. 2. npm persistently stores `https://registry.npmmirror.com` as its package registry. 3. At a later time, the user or an automated process installs or updates an npm package. 4. npm resolves and downloads that package through the third-party mirror. 5. If the mirror or a mirrored artifact has been compromised, npm retrieves attacker-controlled package content. 6. Package lifecycle scripts or imported package code execute with the permissions of the npm process. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user or service account performing the npm installation. This could exp ...[truncated 319 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer the official npm registry: ```bash npm config set registry https://registry.npmjs.org/ ``` - If a mirror is strictly required, scope it to a single command rather than modifying persistent configuration: ```bash npm install --registry=https://registry.npmmirror.com ``` - Clearly disclose that the mirror is a third-party service and explain the associated supply-chain risk. - Provide an explicit restoration command after temporary use. - Pin dependency versions and retain lockfiles. - Use npm integrity verification and review lifecycle scripts before installation. - Avoid running npm package installation commands with administrative privileges. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:33
• Finding: Overbroad Ownership Change Makes System-Wide Node Modules User-Writable<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 33-34 **Vulnerability Type**: Weakening of filesystem ownership and least-privilege boundaries **Risk Level**: High ### Vulnerable Code ```bash sudo chown -R $(whoami) ~/.npm sudo chown -R $(whoami) /usr/local/lib/node_modules ``` ### Technical Analysis The second command recursively transfers ownership of the system-wide global Node module directory to the current user. This weakens the normal separation between privileged system-managed software and unprivileged user-controlled files. Once `/usr/local/lib/node_modules` is user-writable, any process operating as that user can modify globally installed modules without additional authorization. Globally exposed commands commonly reference files inside this directory. Modifying a module entry point or executable can therefore cause attacker-controlled code to run when another user, administrator, service, or trusted workflow invokes the affected global package. The use of `$(whoami)` is not itself an injection issue in this fixed command, but the recursive ownership change is unnecessarily broad. The command alters every descendant rather than identifying and correcting only the files responsible for the original permission error. ### Attack Path 1. A user follows the documented permission troubleshooting instructions with `sudo`. 2. Ownership of `/usr/local/lib/node_modules` and all of its contents is assigned to that unprivileged user. 3. Malware or another process running under the same account modifies a globally installed module or command implementation. 4. A trusted user, administrator, build process, or service later invokes the affected global Node command. 5. The modified code executes in that workflow's security context. 6. If the invoking workflow has greater privileges, the attacker may gain access beyond the original user's permissions. ### Impact Assessment The immediate privilege obtained is write access to globally i ...[truncated 470 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not recursively transfer ownership of `/usr/local/lib/node_modules` to an unprivileged user. - Diagnose the exact files producing the permission error and repair only incorrect ownership entries. - Prefer a user-scoped Node installation managed through a version manager such as `nvm`, `fnm`, or `asdf`. - Alternatively, configure a user-owned npm prefix: ```bash mkdir -p "$HOME/.npm-global" npm config set prefix "$HOME/.npm-global" ``` - Add the user-owned binary directory to `PATH` without changing ownership of system directories. - Restore system-managed global module ownership to the appropriate administrative account and group. - Audit global modules and their executable links for unauthorized modifications after any ownership change. - Avoid recommending `sudo` as a general solution to npm permission problems. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:127
• Finding: Destructive Database and Configuration Resets Lack Adequate Safeguards<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 127-143 **Vulnerability Type**: Unsafe destructive operations with incomplete backup and recovery controls **Risk Level**: Medium ### Vulnerable Code ```bash cp -r ~/.openclaw/data ~/.openclaw/data.bak openclaw db reset ``` ```bash openclaw config list openclaw config reset ``` ### Technical Analysis The documentation recommends database and configuration reset operations that may remove or replace persistent application state. These operations are presented without an explicit warning, confirmation procedure, service shutdown requirement, or tested restoration process. The database backup uses a fixed destination, `~/.openclaw/data.bak`. If that path already exists, recursive copying may merge new content into an old backup instead of creating a clean recovery snapshot. This can produce a backup with an inconsistent mixture of versions. The instructions also do not verify that the copy completed successfully before resetting the database. The configuration reset is more severe from a recoverability perspective because no configuration backup is created. Running `openclaw config list` only displays configuration and does not establish a restorable backup. Depending on the command's behavior, users may lose provider settings, connection details, integration configuration, and other operational state. ### Attack Path 1. A user encounters an application problem and follows the advanced troubleshooting section. 2. The user copies database files to a fixed backup destination that may already contain stale data. 3. No backup integrity or restoration test is performed. 4. The user executes `openclaw db reset`, destroying or replacing active database state. 5. The user may also execute `openclaw config reset` without creating any configuration backup. 6. Recovery fails because the database backup is incomplete or inconsistent, or because no restorable configuration backup exists. 7. The a ...[truncated 826 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Mark all reset operations as destructive and require explicit user confirmation before execution. - Stop OpenClaw cleanly before copying live database files. - Create timestamped backups rather than using a fixed destination: ```bash backup_dir="$HOME/.openclaw/backup-$(date +%Y%m%d-%H%M%S)" mkdir -p "$backup_dir" cp -a "$HOME/.openclaw/data" "$backup_dir/data" ``` - Back up configuration as well as database data before any reset. - Use an application-supported export or snapshot mechanism when available instead of directly copying live database files. - Verify backup completion, file counts, permissions, and integrity before proceeding. - Document and test restoration commands. - Prevent reset execution when backup creation fails. - Recommend reset only as a last resort after non-destructive diagnostics and repair options have been exhausted. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The description and operational guidance are written entirely in Chinese, and the skill name suffix (`-cn`) suggests a forced locale. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 修复 npm 权限
sudo chown -R $(whoami) ~/.npm
sudo chown -R $(whoami) /usr/local/lib/node_modules
```

• Confidence: 88% confidence
• Finding: The skill instructs users to run a recursive sudo chown over the npm directory. Privileged ownership changes can weaken local security boundaries, mask underlying permission problems, and if paths are mistyped or altered, affect more files than intended.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# 修复 npm 权限
sudo chown -R $(whoami) ~/.npm
sudo chown -R $(whoami) /usr/local/lib/node_modules
```

### 网络超时

• Confidence: 88% confidence
• Finding: This command recursively changes ownership of a system-wide Node modules directory using sudo, which can impact all users and packages on the machine. In a troubleshooting guide, such a fix may be copied without understanding the broader security and stability implications of modifying privileged installation paths.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill shows commands that transmit secrets to external services, including a Telegram bot token in a URL and a bearer API key in an HTTP header, without warning users about shell history, terminal logging, process inspection, or accidental sharing. While the commands are common for connectivity tests, they normalize handling credentials unsafely and can lead to token exposure.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 测试连接
curl https://api.telegram.org/bot<YOUR_TOKEN>/getMe
```

### Discord 连接失败

• Confidence: 90% confidence
• Finding: The command sends a Telegram bot token to an external endpoint as part of the request URL. Although this is the expected API usage, presenting it without safety guidance can expose the token through shell history, copied terminal output, browser or proxy logs, and support transcripts.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 验证 DeepSeek Key
curl -H "Authorization: Bearer YOUR_KEY" \
  https://api.deepseek.com/v1/models
```

### 余额不足

• Confidence: 90% confidence
• Finding: The command transmits a live API key in an Authorization header to an external service. This is operationally normal for validation, but without warnings it can still leak through terminal recording, debug tooling, shared shell history, or copied logs.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The troubleshooting guide includes destructive recovery actions such as resetting the database and configuration, but it does not clearly warn that these steps can cause irreversible data loss or service disruption. In a troubleshooting context, users may run such commands under stress and accidentally destroy working state or backups they still need.

Static analysis

No suspicious patterns detected.