Winchester Physics Bare Metal

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:17 AM UTC
• Version: 1.0.0

Overview

This appears to be a local physics LLM configuration, but it enables broad host, Discord, memory, and logging access that is not adequately scoped or explained.

Review this before installing. It is not just a model-performance preset: it can expose a broadly capable, unsandboxed agent through Discord, persist conversation-derived memory, inherit shell environment data, and log without redaction. Use only in an isolated trusted environment, and consider disabling elevation by default, wildcard Discord access, name matching, bot access, Discord config writes, shell environment inheritance, broad device/file plugins, and unredacted logging.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: config.json:4
• Finding: Elevated Privileges and Full Tool Access Enabled by Default<![CDATA[ ## Vulnerability Details **File Location**: `config.json`, lines 4-12 and 46-61 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High ### Vulnerable Code ```json "defaults": { "workspace": "/home/dezritawre/.openclaw/workspace", "model": { "primary": "ollama/gemma4" }, "models": { "ollama/gemma4": {} }, "elevatedDefault": "on", "thinkingDefault": "low" } ``` ```json "tools": { "profile": "full", "web": { "search": { "provider": "duckduckgo", "enabled": true } }, "elevated": { "enabled": true, "allowFrom": { "discord": [ "1196026771036975145" ] } }, ``` ### Technical Analysis The agent starts with elevated operation enabled and uses the unrestricted `full` tool profile. Elevated access is also explicitly exposed to a Discord identity. This breaks least privilege because the documented purpose is local theoretical-physics research and model optimization, which does not inherently require privileged host operations or a complete tool set. Although execution requests are configured with `"ask": "always"` elsewhere in the file, approval prompts are only a mitigating control. They do not remove the elevated capability, and their effectiveness depends on correct runtime enforcement and informed operator approval. ### Attack Path 1. An attacker compromises the authorized Discord account, impersonates an accepted identity through another configuration weakness, or injects malicious instructions into a trusted conversation. 2. The agent processes the malicious request with the full tool profile. 3. The request causes the model to propose an elevated tool operation. 4. If approval is bypassed, incorrectly enforced, or obtained through social engineering, the operation executes with elevated privileges. 5. The attacker can then access or modify resources available to the elevated runtime. ### Impact Assessment Successful exploita ...[truncated 279 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Set `"elevatedDefault"` to `"off"`. - Replace `"profile": "full"` with a minimal profile containing only tools required for local physics research. - Disable the elevated tool facility unless there is a documented operational requirement. - If elevation is unavoidable, restrict it to local administration sessions rather than chat channels. - Preserve mandatory per-operation approval and require the prompt to display the exact command, arguments, working directory, and requested privilege. - Run the agent under a dedicated, unprivileged operating-system account with filesystem and process isolation. - Add audit logging for every privileged request, approval decision, and resulting operation. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: config.json:377
• Finding: Discord Access Control Permits Wildcards, Bots, Unsafe Name Matching, and Configuration Writes<![CDATA[ ## Vulnerability Details **File Location**: `config.json`, lines 377-406 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High ### Vulnerable Code ```json "discord": { "configWrites": true, "allowBots": true, "dmPolicy": "pairing", "enabled": true, "healthMonitor": { "enabled": true }, "heartbeat": { "showAlerts": true, "showOk": true, "useIndicator": true }, "name": "George", "status": "online", "groupPolicy": "allowlist", "agentComponents": { "enabled": true }, "dm": { "enabled": true, "groupEnabled": true, "policy": "pairing" }, "allowFrom": [ "", "*" ], "dangerouslyAllowNameMatching": true } ``` ### Technical Analysis The Discord channel accepts a wildcard sender entry, permits bot-originated messages, enables explicitly dangerous name-based matching, and allows channel-driven configuration writes. Stable platform user IDs are safer authorization principals than mutable display names. The pairing and group allowlist settings provide partial mitigation, but their protection is undermined by the wildcard authorization and unsafe name matching. Enabling configuration writes increases the consequence of any authorization failure because an accepted sender may be able to alter persistent behavior. ### Attack Path 1. An attacker sends a message through an accepted Discord context, uses a bot, or adopts a display name matching a trusted identity. 2. The wildcard or name-matching behavior treats the attacker as an allowed sender, subject to the runtime interpretation of pairing and group policy. 3. The attacker submits instructions requesting tool use or configuration changes. 4. Because `configWrites` is enabled, accepted configuration operations can persistently broaden access or weaken safeguards. 5. The modified agent can subsequently expose tools or data to the attacker. ### Impact Assessment Exploitation could permit unautho ...[truncated 275 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `"*"` and the empty string in `allowFrom` with an explicit list of immutable Discord user IDs. - Set `"dangerouslyAllowNameMatching": false`. - Set `"allowBots": false` unless individual bot IDs are explicitly required and allowlisted. - Set `"configWrites": false` for all remote messaging channels. - Restrict configuration changes to authenticated local administration. - Disable group direct messages unless they are operationally required. - Retain pairing but do not treat pairing alone as authorization for privileged operations. - Require separate authorization rules for ordinary chat, tool use, elevation, and configuration changes. - Review existing pairings and configuration history for unauthorized identities or modifications. ]]>

T02 · Agent Memory Poisoning

Error

• Location: config.json:107
• Finding: Untrusted Conversation Content Can Influence Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `config.json`, lines 107-130 **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Vulnerable Code ```json "skills": { "triage": { "enabled": true }, "recall": { "enabled": true, "tokenBudget": 1500, "rerank": true, "keywordSearch": true, "identityAlwaysInclude": true }, "dream": { "enabled": true }, "domain": "companion" } }, "hooks": { "allowConversationAccess": true } } }, "slots": { "memory": "openclaw-mem0" }, ``` ### Technical Analysis The Mem0 plugin is assigned as the active memory provider, can access conversation content, and enables triage, recall, and dream processing. Recalled identity information is always included. These settings create a path for conversation-derived data to persist and influence later sessions. This becomes especially risky because the Discord configuration accepts broad sender patterns and bots. If attacker-controlled content is selected for memory, it may later be recalled as trusted context. The configuration does not show provenance enforcement, trust separation, approval before persistence, or sanitization of instruction-like content. ### Attack Path 1. An attacker obtains access to an accepted Discord conversation. 2. The attacker submits content framed as a durable fact, identity attribute, preference, or instruction. 3. Conversation access allows the memory plugin to inspect that content. 4. Triage or dream processing selects and stores some or all of the content in the persistent memory backend. 5. Recall retrieves the poisoned entry during a later conversation. 6. The agent treats the recalled material as context, potentially changing decisions or disclosing stored information across sessions. ### Impact Assessment The attack can produce cross-session behavioral manipulation, durable false identity information, contaminated responses, and privacy leakage through later recall. Its persist ...[truncated 167 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Set `allowConversationAccess` to `false` by default. - Disable dream processing for conversations containing remote or untrusted participants. - Require explicit user approval before conversation content is written to persistent memory. - Separate memory namespaces by immutable user and channel identifiers. - Never promote instructions, authorization claims, or identity changes from chat directly into durable memory. - Attach source, author, timestamp, trust level, and originating channel metadata to every memory. - Sanitize recalled content and present it as untrusted data rather than executable instructions. - Remove `identityAlwaysInclude` unless identity entries are administrator-managed and integrity-protected. - Provide memory inspection, deletion, expiration, and rollback controls. - Audit the existing `mem0_768d` collection for attacker-authored or instruction-like entries. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: config.json:408
• Finding: Shell Environment Is Exposed to the Agent<![CDATA[ ## Vulnerability Details **File Location**: `config.json`, lines 408-411 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High ### Vulnerable Code ```json "env": { "shellEnv": { "enabled": true } }, ``` ### Technical Analysis Enabling the shell environment can make host environment variables available to agent processes or tool execution. Environment variables commonly contain API keys, authentication tokens, proxy credentials, service endpoints, and operational settings. This exposure is particularly dangerous alongside remote Discord input, the full tool profile, and disabled sensitive-data redaction. A prompt-injection or authorization failure could cause environment values to be read and returned through tool output or logs. ### Attack Path 1. An attacker reaches the agent through an accepted chat or injected external input. 2. The attacker persuades the agent to inspect environment variables, execute an environment-printing command, or trigger an error containing environment data. 3. The enabled shell environment supplies host values to the relevant process. 4. Tool output, model output, or unredacted logs capture the sensitive values. 5. The attacker obtains credentials or uses them to access associated services. ### Impact Assessment Exploitation may disclose every secret inherited by the OpenClaw process. Compromised credentials could permit access beyond the local host, depending on the permissions attached to each token or key. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Set `shellEnv.enabled` to `false`. - Supply only individually required, non-secret variables to each tool. - Store secrets in a dedicated secret manager and provide scoped, short-lived credentials at execution time. - Remove inherited credentials from the parent OpenClaw process. - Block commands and tool operations that enumerate the environment. - Rotate any credentials that may already have appeared in conversations or logs. - Run tools in a sandbox with a clean environment and an explicit variable allowlist. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: config.json:412
• Finding: Sensitive-Data Redaction Is Disabled<![CDATA[ ## Vulnerability Details **File Location**: `config.json`, lines 412-415 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```json "logging": { "redactSensitive": "off" }, ``` ### Technical Analysis The logging configuration explicitly disables sensitive-data redaction. Tool parameters, responses, errors, model context, environment values, user messages, and service metadata may consequently be recorded without masking. This weakness is amplified by the enabled shell environment and persistent conversation processing. The project contains no compensating log filter, field allowlist, or secret-scrubbing configuration. ### Attack Path 1. A user or tool supplies a credential, private message, environment value, or other secret. 2. The agent processes the value during a conversation or tool operation. 3. Logging records the related request, response, or error without redaction. 4. An attacker or unauthorized operator gains read access to the log destination. 5. The recorded secret is reused to access the corresponding account or service. ### Impact Assessment Potentially exposed data includes API keys, session tokens, personal conversation content, local paths, operational metadata, and tool arguments. The scope depends on what the runtime logs and who can read or export those logs. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Enable sensitive-data redaction. - Configure masking for authorization headers, cookies, tokens, passwords, environment variables, and common secret formats. - Prefer a field allowlist over attempting to denylist every sensitive field. - Prevent full conversation bodies and raw tool output from entering production logs. - Restrict log permissions and central-log access using least privilege. - Define short retention periods and secure deletion procedures. - Review existing logs and rotate credentials found in them. - Add automated tests that verify representative secrets are removed before log emission. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: config.json:132
• Finding: Broad Device and Data-Transfer Plugins Exceed the Documented Purpose<![CDATA[ ## Vulnerability Details **File Location**: `config.json`, lines 132-145 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```json "allow": [ "openclaw-mem0", "browser", "device-pair", "file-transfer", "phone-control", "talk-voice", "tts-local-cli", "discord", "ollama", "duckduckgo" ], "bundledDiscovery": "allowlist" ``` ### Technical Analysis The plugin allowlist includes browser access, device pairing, file transfer, and phone control. These capabilities are unrelated to the stated local theoretical-physics and model-performance purpose. Merely appearing in the plugin allowlist does not prove that every plugin is active or exploitable, but it makes the components discoverable or eligible for use and unnecessarily expands the attack surface. When combined with permissive remote-channel access and a full tool profile, these plugins can increase the consequences of prompt injection or authorization failure. ### Attack Path 1. An attacker obtains an accepted conversation path or injects instructions through processed content. 2. The attacker requests an operation involving an allowed browser, paired device, local file, or phone-control capability. 3. If the corresponding plugin is installed, initialized, and authorized, the agent invokes it. 4. The plugin accesses data or performs actions within its granted scope. 5. Results may be disclosed through the conversation, or device state may be modified. ### Impact Assessment Depending on runtime authorization and plugin activation, the exposed scope may include local file transfer, browser-mediated data access, paired-device interaction, or phone operations. No evidence in the audited files proves that these capabilities were exploited; the confirmed issue is excessive capability exposure. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `device-pair`, `file-transfer`, `phone-control`, and `browser` unless each has a documented requirement. - Maintain a minimal allowlist centered on the local Ollama model and specifically required research tools. - Require separate explicit authorization before enabling any device or data-transfer capability. - Apply per-plugin filesystem, network, and device restrictions. - Periodically compare the active plugin set against the documented purpose. - Log and alert on plugin activation, pairing events, file transfers, and device-control requests. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: config.json:430
• Finding: Tool Errors Are Suppressed from Operator-Facing Messages<![CDATA[ ## Vulnerability Details **File Location**: `config.json`, lines 430-434 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```json "messages": { "suppressToolErrors": true, "groupChat": { "visibleReplies": "message_tool" }, ``` ### Technical Analysis Tool errors are suppressed from messages. Error suppression can prevent users and operators from recognizing denied commands, repeated exploitation attempts, malformed tool requests, partial failures, or unexpected access patterns. Raw errors should not be exposed to untrusted users because they may contain sensitive implementation details. However, fully suppressing them without a visible sanitized failure indication reduces observability, especially when sensitive log redaction is also disabled. ### Attack Path 1. An attacker submits requests designed to probe available tools, permissions, paths, or command behavior. 2. The tool generates failures while the attacker iterates on the request. 3. Suppression prevents normal operator-facing messages from showing those failures. 4. The attacker continues probing until a request succeeds or a control is bypassed. 5. Detection and incident response are delayed because failures were not surfaced through the normal monitoring path. ### Impact Assessment This setting does not independently grant privileges, but it weakens detection and can conceal exploitation attempts or unsafe tool behavior. The resulting scope depends on the privileges of the tool eventually reached by the attacker. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Show users a sanitized failure message containing a request ID and general error category. - Send detailed errors to a protected operational log with sensitive fields redacted. - Alert on repeated authorization failures, invalid tool requests, and elevated-operation failures. - Ensure suppression cannot hide audit records or security events. - Correlate chat requests, approval decisions, tool invocations, and errors using immutable event identifiers. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly advertises that it is "fully unsandboxed" but does not provide any warning about the security implications of running with unrestricted system access. In an agent-skill context, normalizing unsandboxed execution increases the chance that users deploy the skill with excessive privileges, which can lead to filesystem, process, or network abuse if the skill or its dependencies behave unexpectedly.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The configured TTS model path explicitly selects `vits-piper-en_US-lessac-high`, which hard-codes an English (US) voice locale. This is a natural-language locale constraint with no visible opt-in, alternative locale selection, or justification in the file.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: config.json:151