ClawHub
Back to skill

Security audit

Claw Config

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly transparent, but it gives agents persistent OpenClaw configuration-changing power and includes escape paths that users should review before installing.

Install only if you intentionally want agents to inspect and modify their OpenClaw configuration. Require a human-reviewed plan diff before any apply, do not allow --force-shared except under direct operator control, and avoid using the docs command with non-OpenClaw URLs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
raise RuntimeError(f"docs fetch disabled in cron and no cached copy at {cache_file}")

    try:
        p = subprocess.run(
            ["curl", "-fsSL", "--max-time", "10", url],
            capture_output=True, text=True, timeout=12,
        )
Confidence
97% confidence
Finding
p = subprocess.run( ["curl", "-fsSL", "--max-time", "10", url], capture_output=True, text=True, timeout=12, )

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares itself user-invocable and describes capabilities to read environment variables, read and write files, and invoke shell commands, but it does not declare permissions. That mismatch is dangerous because callers and policy engines cannot accurately reason about what the skill can do, especially since it can modify `~/.openclaw/openclaw.json`, create backups, and fetch remote docs.

Description-Behavior Mismatch

Medium
Confidence
99% confidence
Finding
The docs command explicitly accepts arbitrary http/https URLs, not just official docs content. That turns a documentation lookup feature into a generic network access mechanism, which can be abused to reach internal services, exfiltration endpoints, or attacker-controlled content sources.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill's mission is self-diagnosis and safe config editing, but the docs feature exposes a reusable network fetch capability not necessary for that core function. In an agent environment, any extra fetch primitive increases attack surface because prompts or tools may coerce the agent into contacting attacker-selected endpoints and consuming untrusted content.

Self-Modification

High
Category
Rogue Agent
Content
# claw-config

Shared skill for the OpenClaw self-hosted agent gateway that lets any single agent safely self-diagnose and self-modify its own slice of `~/.openclaw/openclaw.json` without hallucinating field names, identity, or paths.

Python 3 · stdlib only · MIT
Confidence
93% confidence
Finding
self-modify

Session Persistence

Medium
Category
Rogue Agent
Content
> *"Who am I, what does my own config look like, and how do I change it safely?"*

**Design principle: no hallucination.** Every field name, every JSON pointer, every current value is read from the installed `openclaw` CLI at call time (`openclaw config schema`, `openclaw config get`). Every write goes through `openclaw config patch` (which validates against the schema internally). When the agent needs to know what a field *does*, the skill fetches the official documentation from `docs.openclaw.ai` (Mintlify `.md` raw + full-content index `llms-full.txt`) — never the model's training memory.

**Comparison with `openclaw doctor`**: `doctor` is a system-wide health check (gateway / secrets / channels), human-readable output. `claw-config` is **agent-scoped** (sliced by `$OPENCLAW_AGENT_ID` — only sees the caller's own config) and supports `--json` for downstream tooling. They are complementary, not duplicates.
Confidence
76% confidence
Finding
write goes through `openclaw config patch` (which validates against the schema internally). When the agent needs to know what a field *does*, the skill fetches the official documentation from `docs.op

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.