ClawHub
Back to skill

Security audit

Claw Config

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it gives agents persistent configuration-changing power and has under-scoped URL fetching and patch-guard weaknesses that users should review before installing.

Install only if you are comfortable giving this skill persistent access to inspect and modify OpenClaw configuration. Before using `apply`, require human review of the patch, avoid `--force-shared` unless an operator explicitly approves it, and do not pass full URLs to `docs`; use only known OpenClaw documentation slugs until the URL allowlist, cache path containment, and array-replacement guard are fixed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
claw-config.py:546
Finding

Unrestricted Documentation URL Fetching Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
claw-config.py:439
Finding

URL-Derived Cache Path Traversal Enables Writes Outside the Documentation Cache

Content
View full analysis
/`. 5. `cache_file.parent.mkdir()` creates missing parent directories where permitted. 6. The attacker-controlled HTTP response is written to the escaped destination using `write_te ...[truncated 1162 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
claw-config.py:190
Finding

Cross-Agent Protection Can Be Bypassed Through Destructive Array Replacement

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:49
Finding

Untrusted Remote Documentation Can Influence Security-Sensitive Agent Actions

Content
View full analysis
`.** Do not write `nativeSkill` / `enableSkills` / `commands.skills` from memory. The real names come from the installed binary's schema. 4. **Before composing a patch, read the docs.** Run `docs ` (e.g., `cli/config`, `channels/telegram`, `tools/skills`, `cli/cron`, `gateway/config-agents`, `announcements`). If you do not know which page is relevant, run `docs` (no argument, prints the site index) or `docs search:` (greps the full-content corpus across every page). 5. **Before `apply`, always `plan` first.** `plan` is a dry-run via `openclaw config patch --dry-run`. Read the diff, confirm the validate result. 6. **If `apply` fails, the backup is automatically restored.** Quote the stderr verbatim to the operator. ``` The implementation permits arbitrary remote sources and prints their content directly: ```python # full URL or slug if topic.startswith("http://") or topic.startswith("https://"): url = topic else: slug = topic.lstrip("/") if slug.endswith(".md"): slug = slug[:-3] url = f"{DOCS_BASE}/{slug}.md" try: body, age = _fetch_docs(url, refresh=refresh, max_age_sec=max_age_sec) except RuntimeError as e: sys.stderr.write(str(e) + "\n"); sys.exit(1) print(body) ``` ### Technical Analysis The Skill establishes fetched documentation as authoritative semantic input immediately before the Agent composes or approves a configuration patch. However, the implementation accepts arbitrary HTTP and HTTPS URLs and prints the returned markdown without marking it as untrusted data. An attacker ...[truncated 2202 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Self-Modification

High
Category
Rogue Agent
Confidence
96% confidence
Finding

This skill is explicitly designed to let an agent modify its own persistent OpenClaw configuration, which is a real self-modification capability. Even with documented guardrails, this is security-sensitive because a compromised or misaligned agent could use the feature to alter command dispatch, bindings, or other persistent behavior and potentially degrade controls or entrench persistence.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md
# claw-config

Shared skill for the OpenClaw self-hosted agent gateway that lets any single agent safely self-diagnose and self-modify its own slice of `~/.openclaw/openclaw.json` without hallucinating field names, identity, or paths.

Python 3 · stdlib only · MIT

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose is a bounded self-diagnosis/config utility, but the observed behavior includes installation into the user's skills directory, PATH persistence via symlink, and preflight/environment manipulation that are not clearly disclosed by the top-level contract. Description-behavior drift is dangerous because operators and calling agents may trust the skill for narrow config inspection while it performs broader persistent system modifications.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The installation instructions place the skill in a shared auto-discovered skills directory and symlink it onto the user's PATH, creating durable session persistence for all agents on the host. This increases risk because any future compromise, prompt injection, or unintended invocation can repeatedly access the installed capability without additional user review.

Content

Scanner excerpt · README.md (reported line 98)May include surrounding context.

md
cd claw-config

# install into your shared OpenClaw skills directory (auto-discovered by every agent)
mkdir -p ~/.openclaw/skills/claw-config
cp SKILL.md claw-config.py ~/.openclaw/skills/claw-config/
chmod +x ~/.openclaw/skills/claw-config/claw-config.py

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises shell, environment, file-read, and file-write capabilities but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an over-privileged execution surface where a caller or downstream agent may invoke destructive operations like config writes, backups, symlink creation, or network-backed docs fetches without a clearly constrained policy boundary.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
> *"Who am I, what does my own config look like, and how do I change it safely?"*

**Design principle: no hallucination.** Every field name, every JSON pointer, every current value is read from the installed `openclaw` CLI at call time (`openclaw config schema`, `openclaw config get`). Every write goes through `openclaw config patch` (which validates against the schema internally). When the agent needs to know what a field *does*, the skill fetches the official documentation from `docs.openclaw.ai` (Mintlify `.md` raw + full-content index `llms-full.txt`) — never the model's training memory.

**Comparison with `openclaw doctor`**: `doctor` is a system-wide health check (gateway / secrets / channels), human-readable output. `claw-config` is **agent-scoped** (sliced by `$OPENCLAW_AGENT_ID` — only sees the caller's own config) and supports `--json` for downstream tooling. They are complementary, not duplicates.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The module docstring states that identity verification makes wrong-agent writes impossible by construction, but later code allows patching shared/non-self sections such as agents.defaults, gateway, secrets, auth, and similar paths when --force-shared is used. That is an active contradiction between the documented safety guarantee and the implemented write behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · claw-config.py (reported line 54)May include surrounding context.

python
def ocw(*args, stdin=None, check=True, timeout=60):
    """Run `openclaw <args>`. Return (stdout, stderr, rc)."""
    try:
        p = subprocess.run(
            [OPENCLAW, *args],
            input=stdin,
            capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
92% confidence
Finding

Although curl is invoked without a shell, this still creates an outbound fetch primitive over attacker-influenced input (url). In a skill intended to retrieve only official docs, this can be abused for SSRF-like access to internal services, metadata endpoints, or unintended egress to arbitrary hosts.

Content

Scanner excerpt · claw-config.py (reported line 458)May include surrounding context.

python
raise RuntimeError(f"docs fetch disabled in cron and no cached copy at {cache_file}")

    try:
        p = subprocess.run(
            ["curl", "-fsSL", "--max-time", "10", url],
            capture_output=True, text=True, timeout=12,
        )

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The docs command accepts any full http:// or https:// URL, contradicting the stated trust boundary that it only fetches official documentation. This widens the skill from a bounded documentation reader into a generic network retrieval tool, enabling data exfiltration paths and access to sensitive internal endpoints if the environment has network reachability.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

This code exposes a general outbound network capability through the ostensibly harmless docs interface. In agent skill context, that is more dangerous than in ordinary CLI tooling because another agent may be induced to use it as a proxy to reach attacker-chosen destinations, bypassing intended capability scoping.

Content

No source excerpt is available for this finding.