ClawHub
Back to skill

Security audit

claw-orchestra

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real multi-agent orchestration skill, but it can spawn tool-using agents without enforced tool limits and can persist task history in plaintext, so it needs review before installation.

Install only in a trusted workspace after confirming the OpenClaw runtime enforces child-agent tool allowlists. Prefer explicit activation, require approval before write/edit/exec/message tools, and disable or redirect the plaintext experience and cost stores if tasks may contain private or proprietary information.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
core/openclaw_adapter.py:194
Finding

Spawned-agent tool restrictions are declared but not enforced

Content
View full analysis

Vulnerability Details

File Location: core/openclaw_adapter.py:194-205
Additional Location: core/four_tuple.py:145-148
Vulnerability Type: Failure to enforce least-privilege tool restrictions
Risk Level: High

Evidence

python
params = {
    "task": task,
    "mode": "run",  # 一次性执行
    "timeoutSeconds": phi.timeout,
}

# 模型（使用指定的或默认的）
model = phi.model if phi.model != "default" else self.default_model
params["model"] = model

# 标签
if phi.role:
    params["label"] = f"{phi.role} [model: {model}]"

The alternative parameter builder has the same issue:

python
params = {
    "task": task,
    "model": self.model,
}

Technical Analysis

AgentTuple.tools is presented as an explicit capability subset for a spawned agent. For example, a researcher is assigned only web_search and web_fetch, while a coder may receive file and command-execution tools.

Neither spawn-parameter builder includes this tool allowlist in the request sent to sessions_spawn. Consequently, the declared restriction is descriptive rather than enforceable. If the external OpenClaw runtime grants a default set of tools, a child agent may receive capabilities such as file writing or command execution even though its tuple appears to restrict it to web research.

This exceeds the minimum privileges required for research and analysis tasks. The issue is compounded by router/tool_router.py, where safe mode defaults to disabled.

Attack Path

  1. An attacker supplies a crafted task, or malicious instructions enter the workflow through fetched content.
  2. The orchestrator creates an AgentTuple that appears to contain a limited tool set.
  3. OpenClawAdapter._build_spawn_params() omits phi.tools.
  4. The injected sessions_spawn implementation creates the child agent using runtime-default tools.
  5. If those defaults include privileged tools, the child agent can be induced to read or modify files, execute commands, or invoke other t ...[truncated 735 chars]
Remediation
View remediation

Remediation Suggestions

  1. Include an explicit tool allowlist in every spawn request using the exact parameter supported by the OpenClaw runtime.
  2. Reject spawning when the runtime cannot guarantee enforcement of the requested tool restrictions.
  3. Validate every tool name against a fixed local allowlist before dispatch.
  4. Enable safe mode by default and require explicit approval before granting exec, process, write, or edit.
  5. Define role-specific maximum privileges, such as web-only access for researchers and read-only access for analysts.
  6. Ensure an empty tool list means “no tools,” not “use runtime defaults.”
  7. Add integration tests that verify a web-only child agent cannot invoke file, process, browser, or messaging tools.
  8. Log the effective tool set returned by the runtime and fail closed if it differs from the requested set.

T01 · Skill Instruction Hijacking

Error
Location
core/orchestrator.py:229
Finding

Untrusted task and child-agent output can influence orchestration control decisions

Content
View full analysis

Vulnerability Details

File Location: core/orchestrator.py:229-246
Additional Locations: core/orchestrator.py:75-87, core/llm_decision.py:105-151
Vulnerability Type: Indirect prompt injection into orchestration decisions
Risk Level: High

Evidence

python
def _build_decision_prompt(self) -> str:
    """构建决策 prompt"""
    return f"""你是编排器（Orchestrator），负责分解任务并委派给子 Agent。

==== 当前状态 ====
原始任务: {self.state.original_task}
当前轮次: {self.state.attempt}/{self.state.max_attempts}

==== 子任务历史 ====
{self.state.format_history()}

==== 可用模型 ====
{self._format_model_table()}

==== 输出格式 ====
返回 JSON:
- 委托子任务: {{"action": "delegate", "reasoning": "...", "params": {{"instruction": "...", "context": [...], "tools": [...], "model": "glm"}}}}
- 完成任务: {{"action": "finish", "reasoning": "...", "params": {{"answer": "..."}}}}

==== 决策 ====
分析任务和子任务历史，决定下一步动作。"""

The resulting model response is parsed directly into an executable orchestration action:

python
if self._llm_fn:
    response = self._llm_fn(prompt)
else:
    response = self._heuristic_decision()

try:
    action = parse_action(response)
except ValueError:
    action = self._heuristic_decision_action()

Child-agent output is also included in the history:

python
if result.success:
    lines.append(f"    结果: {result.output[:100]}...")
else:
    lines.append(f"    错误: {result.error}")

Technical Analysis

The original user task and child-agent results are interpolated into the same natural-language prompt that contains the orchestrator's control instructions. They are not encoded as structured untrusted data, clearly isolated from instructions, or accompanied by a rule prohibiting the decision model from following instructions found inside those fields.

A child agent that retrieves attacker-controlled web content can repeat embedded prompt-injection instructions in its output. That output is then inserted into the next decision prompt. The decision model may i ...[truncated 2151 chars]

Remediation
View remediation

Remediation Suggestions

  1. Treat user tasks, fetched material, and child-agent results as untrusted data rather than instructions.
  2. Pass untrusted fields through a structured API or clearly delimited data object instead of interpolating them into the control prompt.
  3. Add an explicit instruction that content inside task and history fields must never modify orchestration policy.
  4. Validate every parsed action before execution:
    • Restrict models to config.sub_models
    • Restrict tools to a fixed role-specific allowlist
    • Reject unknown action fields
    • Limit instruction and context size
    • Reject privileged actions unless explicitly authorized
  5. Invoke validate_delegate() and extend it to validate tools, context, timeouts, token limits, and role permissions.
  6. Require user confirmation before delegations that request command execution, file modification, messaging, or sensitive context.
  7. Sanitize child-agent results before reusing them in prompts and label their source and trust level.
  8. Use constrained structured output or schema validation for LLM decisions.
  9. Add tests using malicious web content and injected child-agent output to verify that orchestration policy cannot be overridden.

T09 · Insecure Skill Coding Practices

Warning
Location
learner/experience_store.py:65
Finding

Sensitive task and orchestration history can be stored in predictable plaintext files

Content
View full analysis

Vulnerability Details

File Location: learner/experience_store.py:65-97
Additional Location: learner/cost_tracker.py:81-112
Vulnerability Type: Insecure plaintext persistence of potentially sensitive information
Risk Level: Medium

Evidence

python
def __init__(
    self,
    store_path: str = "/workspace/projects/claw-orchestra/experiences.json",
    max_experiences: int = 1000,
):
    self.store_path = store_path
    self.max_experiences = max_experiences
    self.experiences: List[OrchestrationExperience] = []
    self._load()

def _load(self):
    """从文件加载经验"""
    if os.path.exists(self.store_path):
        try:
            with open(self.store_path, 'r', encoding='utf-8') as f:
                data = json.load(f)
                self.experiences = [
                    OrchestrationExperience.from_dict(e)
                    for e in data.get('experiences', [])
                ]
        except Exception as e:
            print(f"[ExperienceStore] 加载失败: {e}")
            self.experiences = []

def _save(self):
    """保存经验到文件"""
    os.makedirs(os.path.dirname(self.store_path), exist_ok=True)
    with open(self.store_path, 'w', encoding='utf-8') as f:
        json.dump({
            'experiences': [e.to_dict() for e in self.experiences],
            'updated_at': datetime.now().isoformat(),
        }, f, ensure_ascii=False, indent=2)

The stored experience object includes the original task and generated subtasks:

python
exp = OrchestrationExperience(
    task=task,
    task_type=task_type,
    subtasks=subtasks,
    strategy="parallel" if len(subtasks) > 1 else "single",
    success=success,
    total_duration=duration,
    total_tokens=tokens,
)

The cost tracker similarly stores task descriptions, session identifiers, and agent labels in /workspace/projects/claw-orchestra/costs.json.

Technical Analysis

Task descriptions and subtasks may contain proprietary data, personal information, file conte ...[truncated 1904 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make task-history persistence disabled by default and require explicit user or administrator opt-in.
  2. Store only the minimum metadata needed for routing and cost analysis.
  3. Redact credentials, tokens, personal data, file contents, and internal URLs before serialization.
  4. Avoid retaining complete original tasks and subtasks; use normalized categories, non-reversible identifiers, or keyed hashes where possible.
  5. Place records in a user-scoped application data directory rather than a shared project path.
  6. Create files with permissions limited to the owning user, such as mode 0600, and verify directory permissions.
  7. Encrypt sensitive records at rest using a deployment-managed key when retention is required.
  8. Define configurable retention limits and provide deletion and export controls.
  9. Use atomic writes with a securely created temporary file followed by replacement.
  10. Document exactly what is retained, for how long, and which local principals can access it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (39)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The supplied code chunk does not implement a multi-agent orchestrator. Its primary function is routing a single task to an LLM/model based on task type and cost heuristics. While 'smart routing' is partially represented through model selection, the broader declared capabilities—creating and coordinating sub-agents, parallel execution, experience storage, and orchestration around the AOrchestra 4-tuple abstraction—are not present in this code. The code does include lightweight cost estimation/adjustment, but not comprehensive cost tracking as declared. Therefore the description materially overstates and misrepresents this specific code chunk’s behavior.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · core/llm_decision.py (reported line 156)May include surrounding context.

python
现在请决策下一步动作："""
        
        return prompt
    
    def _format_history(self, history: List[Dict[str, Any]]) -> str:
        """格式化历史"""

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

The description explicitly labels the skill as '原生' for a Chinese-language presentation, and the README consistently presents usage and activation in Chinese without offering a language choice. Under the stated policy, language constraints should be opt-in or clearly justified as region-specific; this file does not document such an opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list contains broad, common terms such as '编排', '协调器', '指挥官', and 'orchestra/orchestrate' that may appear in ordinary user requests unrelated to this skill. In an agent platform, overly generic activation phrases can cause unintended skill invocation, leading to unexpected delegation, extra tool use, parallel sub-agent spawning, and unnecessary cost or data exposure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill directs the agent to generate and send a Markdown file, which implies file write capability, but it does not declare an explicit tool scope or permissions boundary. Undeclared file access increases the risk of unexpected filesystem actions and weakens user/operator visibility into what the skill may create or read.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger list contains broad terms such as orchestrator, coordination, task decomposition, and common Chinese phrases that may match ordinary user requests unintentionally. Overbroad activation can cause the skill to engage when not intended, leading to unnecessary sub-agent spawning, file creation, or workflow changes without clear user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill mandates creating and sending an MD file as the default delivery method without warning or obtaining consent from the user. Silent artifact creation can surprise users, leak sensitive content into stored files, and create persistence on disk or in conversation attachments that the user did not request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill hardcodes a model/vendor selection policy around specific internal models and language assumptions without user opt-in. This can route user data to providers or locales they did not choose and may conflict with policy, privacy, or deployment constraints in some environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file contains natural-language instructions and documentation exclusively in Chinese, including the top-level module description and method docstrings. Under the policy rule for language/locale, forcing a specific language without user opt-in or a documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file's user-facing natural-language strings and prompts are entirely written in Chinese, implicitly constraining interaction to a specific language. There is no documented opt-in, locale selection, or justification that this skill is intended only for a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Task text and prior agent outputs are embedded verbatim into the next LLM prompt, and the prompt contains no safeguards around secrets, personal data, or untrusted content. This creates both a data exposure path and a prompt-injection amplification path, since hostile prior outputs can influence future decisions or be echoed into delegated instructions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

When no explicit tool list is provided, the prompt advertises powerful capabilities including file writes and command execution. In an LLM-driven orchestrator, exposing these by default can cause the model to plan destructive or unnecessary actions beyond the user’s intent, especially because no policy gate or confirmation step is described here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code tells the LLM that write and exec are available 'automatically selected' without any warning, approval flow, or user-visible disclosure. This weakens safe prompting boundaries and increases the chance the orchestrator will choose high-risk actions users did not knowingly authorize.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The heuristic completion path concatenates all successful subtask outputs directly into the final answer with no filtering or sensitivity review. If any subtask output contains secrets, internal file contents, or injected instructions, the orchestrator will disclose them verbatim to the caller.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring states '编排器不直接执行环境动作，只做决策' and describes a minimal action space, implying a decision-only coordinator. However, the built-in heuristic creates delegated tasks with concrete tool capabilities ['web_search', 'web_fetch'], meaning the orchestrator actively determines and initiates environment-facing actions through sub-agents rather than remaining purely abstract.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Verbose logging prints delegated outputs, errors, and task details to stdout, which may contain sensitive prompts, retrieved data, secrets, or internal context from sub-agents. In multi-agent orchestration, centralized logging increases the chance of accidental disclosure through console history, CI logs, shared terminals, or hosting platforms.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The default heuristic automatically grants web_search and web_fetch to delegated sub-agents without task-specific authorization, policy checks, or user consent. In an orchestration skill, this expands the capability surface of every first-round task and can lead to unintended external access, data exposure in outbound queries, or execution of networked actions that the caller did not expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file’s human-facing description and user-visible strings are written exclusively in Chinese, including display text returned by formatting methods. There is no indication that users can select their preferred language or that the locale restriction is intentional and documented as a region-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The tracker persists task descriptions, session IDs, model usage, timestamps, and agent labels to a JSON file on disk without any consent flow, minimization, or retention controls. In an orchestration skill, task text may contain sensitive prompts, internal project details, credentials, or user data, so silent persistence increases privacy and data exposure risk if the host filesystem is shared, backed up, or later accessed by other components.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The module description and comments are written entirely in Chinese and present the skill behavior in that locale without any indication of user choice or opt-in. Under the policy, locale constraints should either be optional or explicitly documented as justified and region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code persists raw orchestration experiences to disk, including the original task text and subtask content, in a predictable JSON file under /workspace/projects/claw-orchestra/experiences.json. In an agent-orchestration context, tasks often contain sensitive prompts, internal instructions, credentials, file paths, or user data, so storing them without minimization, consent, access controls, encryption, or retention warnings creates a real confidentiality risk if the host is shared, backed up, or later inspected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file’s natural-language interface documentation, examples, and user-facing descriptions are entirely in Chinese, including the main module description and method docstrings. This imposes a specific language/locale on users and maintainers without any opt-in, alternative language option, or stated region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file contains user-facing natural-language documentation entirely in Chinese, including the module description and usage guidance, without any indication that language selection is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The router can automatically grant powerful tools like write, edit, and exec based only on keyword matching in natural-language task text, with no confirmation, policy gate, or provenance check. In an agent orchestration context this increases the chance that prompt-influenced or attacker-controlled task text escalates an agent from research-only behavior into filesystem modification or command execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The safe_mode filter removes exec/process/write/edit, but still allows message-oriented tools such as message and tts even though the API and comments describe this as a security mode. In a multi-agent orchestrator, outbound messaging can still exfiltrate sensitive data or trigger side effects, so the safety claim is materially incomplete and may cause downstream callers to trust an unsafe tool set.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.