T06 · System Persistence
Error
- Location
install.mjs:62- Finding
Persistent startup hook overwrites existing Agent boot instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Post-Upgrade Auto Repair
Security checks for vulnerabilities and agentic risk
Overview
This repair skill has a plausible purpose, but it installs persistent silent automation, changes OpenClaw configuration, and can send diagnostics using the user’s AI credentials without enough control.
Review carefully before installing. Back up BOOT.md and openclaw.json first, and install only if you accept automatic startup execution, automatic configuration changes, model-account usage, and possible diagnostic data transmission to the configured provider endpoint.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
check.mjs:167- Finding
Shell command injection through untrusted diagnostic output
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
run.mjs:10- Finding
Provider credential and diagnostic data sent to an unrestricted configured endpoint
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
check.mjs:23- Finding
Background health check destructively rewrites the primary OpenClaw configuration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The stated purpose is an OpenClaw health-check and auto-repair tool, but the implementation is actually a generic prompt relay that forwards arbitrary user input to the configured LLM provider using the user's existing credentials. This mismatch is dangerous because it hides broad model-access capability behind a benign-sounding repair-tool description, increasing the chance users will authorize or run it without realizing it can exfiltrate prompts and consume their paid API access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly states it will automatically check and repair issues after restart, but the documentation does not clearly disclose that this may modify OpenClaw configuration or runtime state. Silent or poorly disclosed automatic changes can lead users to authorize behavior they do not fully understand, increasing the risk of unintended configuration drift, service disruption, or unsafe repairs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script automatically rewrites the user's ~/.openclaw/openclaw.json in autoFixConfig() and persists changes with writeFileSync() without prompting, previewing diffs, or creating a backup. Even if the fixes are well-intentioned, silent mutation of security- and connectivity-related configuration can break service, weaken policy settings, or overwrite user intent, especially in an upgrade-repair tool that users may run with trust.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script constructs a problemReport containing diagnostic output, version info, status output, issue details, and the local configuration file path, then forwards it to another script advertised as contacting Claude AI for analysis. This can disclose sensitive operational metadata or secrets embedded in status/error output without informed consent or redaction, and the skill context explicitly says unknown issues are sent to an AI, which increases the likelihood of external transmission.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The installer modifies startup behavior by writing a BOOT.md workflow that automatically executes shell commands and a skill script on every gateway start after version changes. This exceeds a simple file-copy install and creates persistent command-executing automation, which is risky because future changes to the installed skill or environment can cause code to run without fresh user approval.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script unconditionally overwrites BOOT.md with new startup instructions, changing global agent behavior without preserving existing content or clearly warning the user. This can silently remove prior safeguards or custom startup logic and cause unexpected automated execution in a sensitive control plane file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The installer both enables the boot-md hook and configures silent automatic execution ('NO_REPLY') without a clear safety notice or user consent. This reduces transparency and establishes persistence, making it easier for unexpected or unsafe behavior to occur unnoticed on future starts.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script exposes a general-purpose LLM invocation interface by accepting arbitrary command-line text and sending it directly to the configured provider. In the context of a supposed repair utility, that capability is unnecessary and expands the tool into a covert wrapper around the user's API account, enabling unauthorized usage, hidden data transfer, and abuse of provider billing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code silently reads API credentials from the user's local OpenClaw configuration file without any up-front disclosure or consent prompt. Even if the file access is local, this is risky because users invoking a repair skill would not reasonably expect their provider credentials to be harvested and reused by a generic script.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script sends the user's task outbound and authenticates the request with the user's API key, yet gives no user-facing warning that data will leave the machine or that their account will be charged. In this skill context, that omission is more dangerous because the manifest frames the tool as a local repair utility, so users are less likely to anticipate remote transmission of potentially sensitive operational details.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Natural-language policy checks apply to all file types. The file consistently forces a specific language for description and user instructions, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking audience for a documented reason.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
User-facing comments and console output consistently assume Chinese as the interaction language, and the repair prompt sent to CC is also hardcoded in Chinese. There is no indication that users may choose another language or locale, which can violate language-choice policy absent justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file's human-readable title and usage instructions are presented in Chinese only, and the script's console messages are likewise Chinese-only. This can constitute a language policy violation when a skill imposes a specific language without user opt-in or documented locale scoping.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The embedded instruction '不需要回复用户，静默完成即可（NO_REPLY）' directs the system to hide the automated action from the user. This is a natural-language behavior directive that reduces transparency and can conflict with policies requiring user awareness of automated actions.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
All visible usage and error messages in the script are written in Chinese, and there is no option for the user to select another language. This can violate language or locale policy when no explicit opt-in or documented locale restriction is provided.
- Content