Openclaw Security Checklist

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:32 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent OpenClaw security checklist, but it can expose sensitive credentials in reports and includes some risky operational guidance.

Review the shell script and reports before sharing output. Do not run the default audit in directories that may contain live credentials unless you are prepared to sanitize the results. Avoid following the examples that print API keys, append keys to shell profiles, store keys in Docker image ENV values, or replace crontab wholesale. The skill is not clearly malicious, but it needs careful handling in production or sensitive environments.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/security-check.sh:156

Finding

Secret-bearing workspace lines can be exposed through audit output and generated reports

Content

View full analysis

/dev/null | grep -v ".git" | head -5; then print_result "WARN" "Potential hardcoded key detected" "Review the files shown above" fi ``` Related report-generation behavior: ```bash ./scripts/security-check.sh > ~/openclaw-security-report.md ``` ```json "scripts": { "check": "./scripts/security-check.sh", "audit": "./scripts/security-check.sh --verbose", "report": "./scripts/security-check.sh > report.md" } ``` ### Technical Analysis The recursive `grep` command prints complete matching lines from the entire `~/.openclaw/workspace` tree. It does not restrict scanning to source-code directories, exclude logs or Agent memory, or redact token values. Consequently, a line containing a real API key, bearer token, authorization header, or other credential is written directly to standard output. The documented and configured report commands redirect that output into persistent report files. The project also describes reports as suitable for sharing, increasing the chance that credentials will be copied into CI artifacts, support bundles, audit deliverables, backups, or customer-facing reports. The `.git` exclusion is also incomplete: `grep -v ".git"` filters output lines rather than reliably excluding the `.git` directory during traversal. ### Attack Path 1. A real API key or bearer token is present in a source file, log, generated report, conversation memory, or another file under `~/.openclaw/workspace`. 2. The user invokes the recommended audit or report command. 3. Recursive `grep` reads the file and prints the complete matching line ...[truncated 758 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/security-check.sh:138

Finding

The audit enumerates the complete inherited environment to detect secret variables

Content

View full analysis

/dev/null; then print_result "WARN" "API key environment variable detected" "Ensure it is not exposed in logs or error output" fi ``` ### Technical Analysis The `env` command emits every environment-variable name and value inherited by the audit process. Although the pipeline uses quiet matching and does not intentionally print those values to the final report, complete secret values still pass through the command pipeline. This exceeds the minimum access required to determine whether expected OpenClaw credential variables are configured. In CI systems, cloud hosts, and administrative shells, the inherited environment may contain unrelated deployment tokens, cloud credentials, signing keys, or service passwords. There is no demonstrated direct exfiltration in the current implementation, so the risk is lower than the unredacted workspace scan. Nevertheless, broad enumeration unnecessarily expands the sensitive data handled by the Skill. ### Attack Path 1. The audit is run in a shell or CI job containing unrelated secret environment variables. 2. `env` serializes all variable names and values into a pipeline. 3. The complete values become available to the invoked utilities and any instrumented, wrapped, or compromised command on the execution path. 4. A future debugging change, shell tracing configuration, or modified local utility could record those values. ### Impact Assessment The current code does not print matched environment values, and no direct credential theft was identified. The exposure boundary nevertheless includes every environment variable inherited by the current user process, potentially including credentials unrelated to OpenClaw. Any obtai ...[truncated 169 chars]

Remediation

View remediation

/dev/null` for each approved name. Do not enable shell tracing around credential checks, and document which environment variables the audit examines. ]]>

other

Warning

• Location: scripts/security-check.sh:164

Finding

Default audit execution discloses the host public IP to an external geolocation service

Content

View full analysis

/dev/null; then location=$(curl -s ipinfo.io/country 2>/dev/null || echo "UNKNOWN") if [[ "$location" == "CN" ]]; then print_result "PASS" "Server is located in China ($location)" else print_result "WARN" "Server is outside China ($location)" "A cross-border data security assessment may be required" fi fi ``` ### Technical Analysis A normal audit run contacts `ipinfo.io` whenever `curl` is installed. The request reveals the deployment's public source IP, request time, network provider information available to the recipient, and the fact that the host is querying a geolocation endpoint. The request is related to the declared data-border compliance function, but it is not necessary for all audit modes and is not clearly presented as an external disclosure before execution. The command also omits an explicit `https://` scheme, timeout controls, and an offline option. ### Attack Path 1. A user invokes the documented local security audit. 2. The script automatically issues a request to `ipinfo.io`. 3. The external provider receives the deployment's public IP and request metadata. 4. That metadata may be logged, retained, correlated, or processed according to the provider's policies. ### Impact Assessment The issue does not provide shell access or operating-system privileges. It discloses infrastructure metadata to a third party and can violate network-isolation, privacy, or data-residency policies in sensitive environments. The affected scope is the public egress identity of every audited host on which `curl` is available. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/deployment-scenarios/enterprise.md:135

Finding

Certificate-renewal guidance overwrites the user's entire crontab

Content

View full analysis

Remediation

View remediation

/dev/null | grep -Fqx "$job"; then (crontab -l 2>/dev/null; printf '%s\n' "$job") | crontab - fi ``` Before modifying cron state, back up the current crontab and document the execution identity. Add a post-install verification step confirming that pre-existing jobs remain present. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/api-key-management.md:26

Finding

API-key management guidance exposes or persistently stores sensitive key material

Content

View full analysis

> ~/.zshrc # Notify service to reload systemctl restart openclaw-gateway # Disable old key (record in log) echo "$(date): Rotated API key to $NEW_KEY" >> /var/log/key-rotation.log ``` ### Technical Analysis `echo $OPENCLAW_API_KEY` reveals the complete credential in terminal output, which may be captured by terminal recording, CI logs, remote-session logging, screenshots, or support transcripts. The rotation example appends returned AccessKey material to `.zshrc`, causing it to persist in a plaintext shell startup file and propagate to every future interactive shell. It also writes the value to `/var/log/key-rotation.log` without demonstrating restrictive creation permissions or redaction. In addition, the guide describes a plaintext `.env` file protected only by mode `600` as “encrypted.” Filesystem permissions reduce access but do not encrypt the contents at rest, creating a misleading security guarantee. The example extracts `AccessKeyId`, which may be an identifier rather than the provider's secret component. Using it as an API credential is operationally incorrect and still unnecessarily exposes account-linked key metadata. ### Attack Path 1. A user foll ...[truncated 897 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/deployment-scenarios/docker.md:264

Finding

Docker guidance incorrectly persists an API key in image configuration

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (131)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

整体上，代码与“OpenClaw 安全部署检查/报告工具”这一大方向是相关的，确实会执行一系列安全与合规检查并生成报告。但描述中的几个关键承诺没有被代码实现，尤其是 SSH 检查、多部署场景（尤其 Docker/企业）验证，以及“逐项打勾”的交互式清单能力。相反，代码实现了若干未在描述中强调的系统加固/运维检查。由于这些差异涉及核心覆盖范围与使用方式，而不只是实现细节，因此应判定为描述与行为存在实质性不匹配。

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The report discloses that a file contains an Authorization header with a Bearer API key pattern and includes a specific local path to where that sensitive material may reside. Even though the key value is redacted here, documenting the presence and likely storage location of secrets in workspace memory normalizes insecure secret handling and may expose credential-bearing artifacts to logs, reports, backups, or shared diagnostics.

Content

Scanner excerpt · example-report.md (reported line 74)May include surrounding context.

md

| 检查项 | 状态 | 详情 |
|--------|------|------|
| .env 文件权限 | ✅ 通过 | 未发现 .env 文件 |
| 硬编码检测 | ⚠️ 警告 | 检测到可能的硬编码密钥 |

**检测到的文件**:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · example-report.md (reported line 197)May include surrounding context.

grep -i "api_key|sk-" ~/.zsh_history

text

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-key-management.md (reported line 34)May include surrounding context.

grep -i "api_key|sk-" ~/.zsh_history

text

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-key-management.md (reported line 44)May include surrounding context.

grep -i "api_key|sk-" ~/.zsh_history

text

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-key-management.md (reported line 50)May include surrounding context.

grep -i "api_key|sk-" ~/.zsh_history

text

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-key-management.md (reported line 51)May include surrounding context.

grep -i "api_key|sk-" ~/.zsh_history

text

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-key-management.md (reported line 54)May include surrounding context.

grep -i "api_key|sk-" ~/.zsh_history

text

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-key-management.md (reported line 90)May include surrounding context.

grep -i "api_key|sk-" ~/.zsh_history

text

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-key-management.md (reported line 233)May include surrounding context.

grep -i "api_key|sk-" ~/.zsh_history

text

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-key-management.md (reported line 234)May include surrounding context.

grep -i "api_key|sk-" ~/.zsh_history

text

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/api-key-management.md (reported line 297)May include surrounding context.

grep -i "api_key|sk-" ~/.zsh_history

text

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/deployment-scenarios/personal-mac.md (reported line 111)May include surrounding context.

grep -i "api_key|sk-" ~/.zsh_history

text

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security-check.sh (reported line 143)May include surrounding context.

sh

grep -i "api_key\|sk-" ~/.zsh_history
```

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security-check.sh (reported line 144)May include surrounding context.

sh

grep -i "api_key\|sk-" ~/.zsh_history
```

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security-check.sh (reported line 145)May include surrounding context.

sh

grep -i "api_key\|sk-" ~/.zsh_history
```

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security-check.sh (reported line 147)May include surrounding context.

sh

grep -i "api_key\|sk-" ~/.zsh_history
```

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security-check.sh (reported line 149)May include surrounding context.

sh

grep -i "api_key\|sk-" ~/.zsh_history
```

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/security-check.sh (reported line 152)May include surrounding context.

sh

grep -i "api_key\|sk-" ~/.zsh_history
```

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · security-checklist.sh (reported line 57)May include surrounding context.

sh

grep -i "api_key\|sk-" ~/.zsh_history
```

#### 2. 加密的 .env 文件

```bash
# 创建 .env 文件

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The example creates a plaintext ~/.openclaw/.env file using a here-document, despite labeling it as 'encrypted'. This can mislead users into storing live API keys unencrypted on disk, increasing exposure through local compromise, backups, endpoint indexing, or accidental file access.

Content

Scanner excerpt · references/api-key-management.md (reported line 37)May include surrounding context.

2. 加密的 .env 文件

bash

# 创建 .env 文件
cat > ~/.openclaw/.env << EOF
OPENCLAW_API_KEY=sk-...
DASHSCOPE_API_KEY=sk-...

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The snippet writes API keys directly into a plaintext .env file. While common in development, documenting it as a recommended approach without strong caveats can lead to credential exposure if the host, home directory, backups, or support artifacts are accessed.

Content

Scanner excerpt · references/api-key-management.md (reported line 38)May include surrounding context.

bash

# 创建 .env 文件
cat > ~/.openclaw/.env << EOF
OPENCLAW_API_KEY=sk-...
DASHSCOPE_API_KEY=sk-...
EOF

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · references/deployment-scenarios/docker.md (reported line 50)May include surrounding context.

md

# 仅监听本地 socket（推荐）
  # /etc/docker/daemon.json
  {
    "hosts": ["unix:///var/run/docker.sock"]
  }
  
  # 如必须远程访问，使用 SSH 隧道

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/deployment-scenarios/docker.md (reported line 63)May include surrounding context.

cker API 访问**

bash

# 仅监听本地 socket（推荐）
# /etc/docker/daemon.json
{
  "hosts": ["unix:///var/run/docker.sock"]
}

# 如必须远程访问，使用 SSH 隧道
ssh -L 2375:localhost:2375 user@docker-host

• 启用 Docker 内容信任

  bash

  # 启用镜像签名验证
  export DOCKER_CONTENT_TRUST=1
  
  # 添加到 ~/.bashrc 永久生效
  echo "export DOCKER_CONTENT_TRUST=1" >> ~/.bashrc
  

2. 容器安全

• 使用非 root 用户运行容器

  dockerfile

  # Dockerfile 示例
  FROM node:18-alpine
  
  # 创建非 root 用户
  RUN addgroup -g 1001 openclaw && \
      adduser -u 1001 -G openclaw -s /bin/sh -D openclaw
  
  USER openclaw
  
  WORKDIR /home/openclaw
  COPY --chown=openclaw:openclaw . .
  
  CMD ["node", "server.js"]
  

• 限制容器资源

  yaml

  # docker-compose.yml
  services:
    openclaw:
      image: openclaw:latest
      deploy:
        resources:
          limits:
  

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Recommending .env files for secrets, even with a development/testing qualifier, still encourages plaintext secret storage on disk and easy accidental leakage through backups, shell history, local compromise, or misconfiguration. In a security checklist, this is risky guidance unless strongly constrained and paired with safer alternatives.

Content

Scanner excerpt · references/deployment-scenarios/docker.md (reported line 253)May include surrounding context.

openclaw: image: openclaw:latest env_file: - .env

text

```bash

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/api-key-management.md:72