Security audit

OpenClaw Config Reference

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown OpenClaw configuration reference with some sensitive configuration examples, but I found no hidden code, automatic execution, exfiltration, or deceptive behavior.

Install only if you want OpenClaw configuration help. Before applying examples, keep gateways authenticated and loopback-only unless you intentionally expose them, avoid open DM policies with elevated tools, avoid shellEnv: true unless agents should receive your full shell environment, and treat webhooks or Funnel as external exposure points.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
| `session` | Session scoping, reset behavior | [session.md](references/session.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
| `session` | Session scoping, reset behavior | [session.md](references/session.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
md
| `session` | Session scoping, reset behavior | [session.md](references/session.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
md
| `session` | Session scoping, reset behavior | [session.md](references/session.md) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.
md
| `session` | Session scoping, reset behavior | [session.md](references/session.md) |

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/gateway.md (reported line 108)May include surrounding context.
Prefer env vars over config: Store tokens in ~/.openclaw/.env rather than in openclaw.json:

bash
# ~/.openclaw/.env OPENCLAW_GATEWAY_TOKEN=your-secret-token

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/models-env.md (reported line 115)May include surrounding context.
Prefer env vars over config: Store tokens in ~/.openclaw/.env rather than in openclaw.json:

bash
# ~/.openclaw/.env OPENCLAW_GATEWAY_TOKEN=your-secret-token

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/troubleshooting.md (reported line 234)May include surrounding context.
Prefer env vars over config: Store tokens in ~/.openclaw/.env rather than in openclaw.json:

bash
# ~/.openclaw/.env OPENCLAW_GATEWAY_TOKEN=your-secret-token

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/troubleshooting.md (reported line 249)May include surrounding context.
Prefer env vars over config: Store tokens in ~/.openclaw/.env rather than in openclaw.json:

bash
# ~/.openclaw/.env OPENCLAW_GATEWAY_TOKEN=your-secret-token

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · references/session.md (reported line 39)May include surrounding context.
md
| Mode | Behavior | |------|----------| | `daily` | Reset context at `atHour` every day. Agent starts fresh. | | `idle` | Reset after `idleMinutes` of no messages. | | `never` | Never auto-reset. Context grows indefinitely until manual `/new`. |

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · references/session.md (reported line 46)May include surrounding context.
Session Commands (from chat)

text
/new - Start a new session (clear context) /reset - Alias for /new /history - Show session history

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description uses very broad trigger phrases like config, troubleshooting, gateway settings, tools, browser, models, and environment variables, which can cause the skill to be invoked for many generic help requests beyond a narrowly scoped OpenClaw task. Over-broad invocation increases the chance of accidental selection, exposing users to configuration-changing guidance in contexts where a more appropriate or safer skill should answer instead.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation explicitly presents open DM policy as allowing anyone to DM when allowFrom: ["*"] is set, but it does not pair that option with a strong, explicit warning about the security exposure beyond a generic 'High' label in the table. In a configuration reference for agent messaging gateways, this can normalize unsafe deployment choices and lead operators to unintentionally expose agents to unsolicited access, abuse, spam, prompt injection attempts, or unauthorized data access paths.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation explicitly shows controlUi.allowInsecureAuth: true and presents the Control UI over http://127.0.0.1:18789 without a strong warning that credentials or session tokens can be exposed if the UI is accessed over an untrusted network, proxied incorrectly, or used with non-loopback binding. In a configuration reference skill, examples are highly likely to be copied verbatim, so normalizing insecure HTTP authentication increases the chance of unsafe deployments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation includes openclaw gateway --tailscale funnel, which exposes the gateway to the public internet, but does not pair it with a prominent warning about authentication, attack surface increase, and the need to harden exposed endpoints. Because this is operational guidance in a config reference, users troubleshooting connectivity may enable Funnel without understanding that they are making the service internet-reachable.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation states that enabling shellEnv: true causes the agent to inherit all environment variables from the launching shell, but it does not warn that this may expose secrets such as cloud credentials, API tokens, or internal endpoints to agent processes. In an agent platform, that omission is security-relevant because users may enable it for convenience without realizing they are broadly expanding the agent's access to sensitive data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The cron delivery documentation lists webhook as a delivery kind but does not warn that job results may be POSTed to external URLs, potentially transmitting sensitive model output, retrieved data, or tool results outside the local environment. In this config reference, users are being guided to set up automation, so the lack of a data-egress warning can lead to accidental exposure through normal use rather than an overt exploit.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The hooks documentation shows request bodies and headers being interpolated into agent prompts via variables like {body} and {headers.X-Custom}, but it does not clearly warn that untrusted external input is being forwarded into the model context and may later be retransmitted or acted on. In a configuration reference for webhook receivers, this omission materially increases prompt-injection and data-exfiltration risk because operators may expose these endpoints to external systems without understanding the trust boundary.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/session.md (reported line 261)May include surrounding context.
Sending Webhooks

bash
curl -X POST http://127.0.0.1:18789/hooks/custom-event \ -H "Content-Type: application/json" \ -H "Authorization: Bearer shared-secret-token" \ -d '{"event": "order_placed", "amount": 99.99}'

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/tools.md (reported line 25)May include surrounding context.
md
allow: [], // Explicitly allowed tools elevated: { enabled: false // Allow elevated/sudo operations }, exec: {

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/troubleshooting.md (reported line 220)May include surrounding context.
md
allow: [], // Explicitly allowed tools elevated: { enabled: false // Allow elevated/sudo operations }, exec: {

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/troubleshooting.md (reported line 249)May include surrounding context.
Solution: Use ~/.openclaw/.env for secrets:

bash
# In .env (chmod 600) ANTHROPIC_API_KEY=sk-ant-... OPENAI_API_KEY=sk-... OPENCLAW_GATEWAY_TOKEN=your-token

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/session.md:263

Overview

A.I.G

SkillSpector

Ae1

Ae1

Ae1

Ae1

Ae1

Credential Access

Credential Access

Credential Access

Credential Access

Memory Manipulation

Memory Manipulation

Session Commands (from chat)

Vague Triggers

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

External Transmission

Sending Webhooks

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Static analysis

File appears to expose a hardcoded API secret or token.