Openclaw Docs

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:03 AM UTC
• Version: 1.1.0

Overview

This is a documentation skill, but its default setup advice includes a global mutable install and a persistent daemon without enough scoping or removal guidance.

Review the installation commands before using this skill's setup advice. Prefer a pinned OpenClaw version from a verified source, understand what `--install-daemon` creates, and confirm how to stop, disable, and uninstall the daemon before enabling it.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:60

Finding

Persistent Background Service Installation in the Default Setup Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60-63
Vulnerability Type: Persistent service installation
Risk Level: High

Vulnerable Code:

bash

npm install -g openclaw@latest
openclaw onboard --install-daemon
openclaw gateway

Technical Analysis

The default installation template invokes openclaw onboard --install-daemon, which explicitly installs OpenClaw as a background daemon. Unlike foreground execution, a daemon can remain active after the initiating terminal or skill interaction ends and may be configured to start automatically in later sessions.

The workflow does not require explicit informed consent before creating the persistent service. It also does not provide the generated service definition, explain the daemon's operating privileges, restrict its service account, or document how to disable and remove it. This makes the persistent host modification insufficiently transparent.

Persistence becomes particularly consequential because the daemon is installed immediately after acquiring a mutable package version through openclaw@latest. If that package or its dependency chain is compromised, the installed code can retain cross-session execution through the daemon.

Attack Path

1. A user asks the skill for OpenClaw installation or setup instructions.
2. The skill supplies the default installation commands shown above.
3. The user or an automation agent executes the commands.
4. OpenClaw is installed globally and openclaw onboard --install-daemon creates a persistent background service.
5. The installed package continues operating after the original shell or skill session ends.
6. If the installed package is compromised or behaves unexpectedly, its code retains execution through the daemon until the service is explicitly disabled and removed.

Impact Assessment

The daemon can obtain persistent execution with the privileges of the account under which the serv ...[truncated 594 chars]

Remediation

View remediation

Remediation Suggestions

• Remove --install-daemon from the default quick-start workflow and use foreground execution by default.
• Present daemon installation as a separate, optional step that requires explicit user consent.
• Before installation, show the service definition, startup behavior, executable path, service account, filesystem permissions, and network exposure.
• Run the daemon under a dedicated least-privileged account rather than an administrator or broadly privileged user.
• Restrict access to configuration files and credentials used by the service.
• Provide verified commands for stopping, disabling, and completely uninstalling the daemon.
• Require users to review the package version and provenance before enabling persistent execution.
• Document how to inspect service logs and confirm that the daemon is not exposed on unintended network interfaces.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:60

Finding

Mutable Unpinned Package Installed Globally

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 60
Vulnerability Type: Unsafe third-party dependency acquisition
Risk Level: High

Vulnerable Code:

bash

npm install -g openclaw@latest

Technical Analysis

The installation command resolves the mutable npm distribution tag latest rather than an exact, reviewed package version. Consequently, the code installed when the command is executed can change after this skill has been audited without any modification to the skill itself.

npm packages may execute lifecycle scripts during installation. A compromised package release, maintainer account, registry publishing process, or transitive dependency can therefore cause attacker-controlled code to execute with the invoking user's permissions. Global installation increases the impact by placing package executables and files in shared user-level or system-level npm locations.

No version pin, integrity digest, provenance verification, publisher verification, or lifecycle-script restriction is included in the documented workflow. The following --install-daemon command can compound the supply-chain exposure by turning the newly acquired package into a persistent service.

Attack Path

1. An attacker compromises the package publisher, release process, registry account, or a dependency included in a future OpenClaw release.
2. The compromised release is assigned to the mutable latest tag.
3. A user asks the skill for installation instructions and receives npm install -g openclaw@latest.
4. npm resolves and downloads the compromised release rather than a previously reviewed version.
5. Malicious lifecycle scripts or package code execute with the invoking user's permissions.
6. The package is exposed globally through npm's executable and module locations.
7. If the remainder of the documented workflow is followed, the compromised package may install itself as a daemon and retain cross-session ...[truncated 801 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact version that has undergone security review, for example openclaw@X.Y.Z.
• Publish and verify an expected registry integrity digest or other cryptographic artifact for the approved release.
• Verify package ownership, publisher identity, provenance attestations, and release signatures before installation.
• Prefer a project-local installation or isolated environment over global installation where operationally possible.
• Review package and transitive dependency contents before permitting lifecycle scripts.
• Consider initially acquiring the package with lifecycle scripts disabled, then review and explicitly run only required setup operations.
• Establish a controlled upgrade process instead of automatically resolving a mutable distribution tag.
• Do not enable the installed package as a persistent daemon until its exact version and service configuration have been verified.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description says the skill auto-triggers for OpenClaw-related questions, but it does not define clear non-trigger boundaries or disambiguation criteria. In practice, this broad scope increases the chance of accidental invocation and makes it easier for common infrastructure or chat-platform terms to route users into this skill when another skill or the base assistant should respond.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes several generic terms such as channel names, "cron," and "skill," which can appear in many unrelated conversations. This can cause the skill to activate outside its intended OpenClaw context, leading to inappropriate retrieval of documentation, response hijacking, or context confusion in a multi-skill agent environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description states the skill should automatically trigger for broadly any OpenClaw-related question, which can cause over-invocation and unintended interception of user queries. In a documentation skill, this creates a prompt-routing and scope-control weakness: the skill may activate in contexts where it is not the best or safest source, increasing the chance of irrelevant, misleading, or instruction-heavy outputs being injected into conversations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description is written to present the skill as a Chinese-language documentation resource without indicating user choice or fallback behavior. While not inherently malicious, forcing a language can degrade user comprehension, lead to misunderstanding of operational or security-sensitive instructions, and reduce usability when the user's preferred language differs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest description and operating instructions are entirely in Chinese, and the file does not indicate that the user may choose another language. This can be a language-policy issue if the organization expects skills not to force a specific language absent user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.