T03 · Remote Payload Retrieval and Execution
Error
- Location
ClawRouter 安装指南.md:16- Finding
Mutable Remote Installer Is Piped Directly into Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw 集中配置管理系统
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly documentation and templates, but it recommends high-impact installation and configuration patterns that need careful review before use.
Install only if you are comfortable reviewing and tightening the templates first. Avoid the curl-to-bash installer, pin and verify any Docker/source installs, restrict Feishu access to approved users/groups, treat all API keys and bot tokens as secrets, use 600-style permissions for sensitive configs, and do not enable remote memorySearch unless you accept sending indexed memory content to that provider.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)
T08 · Insecure Dependencies
Error
- Location
ClawRouter 安装指南.md:30- Finding
Unpinned Docker, Git, and npm Installation Paths Permit Supply-Chain Code Execution
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
记忆系统配置模板.md:101- Finding
Conversation-Derived Memory May Be Transmitted to a Third-Party Embedding Service
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
ClawRouter 安装指南.md:349- Finding
Troubleshooting Command Exposes the Complete ClawRouter API Key
- Content
View full analysis
- Remediation
View remediation
0' \ ~/.openclaw/config/clawrouter.json >/dev/null ``` 3. If identification is required, display only a short masked suffix. 4. Warn users not to paste credentials into support messages or screenshots. 5. Rotate any credential that has already been exposed through terminal output. 6. Prefer a secret manager or protected environment injection instead of storing the key directly in JSON. ]]>
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
配置模板合集（脱敏版）.md:178- Finding
Open Messaging Policies Expose Tool-Enabled Agents to Untrusted Users
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:205- Finding
Broad Permission Commands Make Configuration Files World-Readable
- Content
View full analysis
/dev/null /usr/local/bin/jq -r ".$key // empty" "$file" 2>/dev/null } ``` The consolidated template repeats the broad permission recommendation: ```bash chmod 755 ~/.openclaw/config chmod 755 ~/.openclaw/config/agents chmod 755 ~/.openclaw/config/channels chmod 644 ~/.openclaw/config/*.json chmod 644 ~/.openclaw/config/agents/*.json chmod 600 ~/.openclaw/config/channels/feishu.json ``` ### Technical Analysis Mode `644` allows every local account to read the affected configuration files. Mode `755` similarly allows other users to list or traverse the configuration directories when parent-directory permissions permit it. Although one Feishu configuration file receives mode `600`, the project also stores device identifiers, API endpoints, model settings, workspace locations, and potentially future credentials in other JSON files. The loader's `chmod 644` is particularly unsafe because a function intended only to read configuration has the side effect of weakening file permissions every time it runs. This behavior is unnecessary for configuration loading and violates least privilege. ### Attack Path 1. A user follows the documented permission commands, or a script invokes `load_config`. 2. One or more OpenClaw configuration files are changed to mode `644`. 3. Another local account or a compromised low-privilege process enu ...[truncated 627 chars]- Remediation
View remediation
/dev/null`; report insecure ownership or modes clearly. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (48)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
Fetching an installation script from a remote domain and executing it as part of setup is a classic supply-chain risk. Users are asked to trust both the remote host and the transport path with immediate code execution, making compromise of either highly impactful.
- Content
bash # 1. 安装 ClawRouter curl -fsSL https://blockrun.ai/ClawRouter-update | bash # 2. 重启 OpenClaw Gateway openclaw gateway restart
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The
| bashchain removes the user’s chance to inspect the downloaded content before it runs, compounding the risk of the external script fetch. In a configuration/operations skill, this is especially dangerous because users are likely to run commands verbatim on real systems.- Content
bash # 1. 安装 ClawRouter curl -fsSL https://blockrun.ai/ClawRouter-update | bash # 2. 重启 OpenClaw Gateway openclaw gateway restart
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
This line explicitly fetches and executes an external script from
https://blockrun.ai/ClawRouter-update, which is a classic supply-chain hazard. In the context of an agent skill intended to guide installation, this is more dangerous because users may copy-paste it verbatim and grant the script access to their workstation, credentials, configs, and local services.- Content
方式 1: 一键安装 (推荐)
bash curl -fsSL https://blockrun.ai/ClawRouter-update | bash openclaw gateway restart
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The
| bashchaining turns a network fetch into immediate shell execution with no review boundary, magnifying the risk of malicious or tampered content. Combined with the document's recommendation wording, it lowers user caution and increases the likelihood of unsafe execution.- Content
方式 1: 一键安装 (推荐)
bash curl -fsSL https://blockrun.ai/ClawRouter-update | bash openclaw gateway restart
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
bash # 简单任务 - 使用便宜模型 openclaw agent --model gpt-4o-mini --message "提取 JSON" # 复杂任务 - 使用 Claude openclaw agent --model claude-sonnet-4 --message "架构设计"
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
openclaw agent --model gpt-4o-mini --message "提取 JSON"
复杂任务 - 使用 Claude
openclaw agent --model claude-sonnet-4 --message "架构设计"
text ---
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template instructs the agent to automatically read multiple local context files, including USER.md and MEMORY.md, and explicitly says 'Don't ask permission. Just do it.' That removes user opt-in for potentially sensitive personal or historical data access and normalizes silent collection of context beyond the immediate task.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Safety - Don't exfiltrate private data. Ever. - Don't run destructive commands without asking. - `trash` > `rm` (recoverable beats gone forever) - When in doubt, ask.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide recommends
curl ... | bash, which downloads and immediately executes remote code without requiring the user to inspect or verify it. If the upstream site, network path, or update script is compromised, users can suffer arbitrary code execution on their machine.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guide instructs users to place an API key into a config file but does not clearly warn that the key is sensitive or provide handling guidance beyond file permissions. Users may accidentally paste real credentials into shared terminals, screenshots, repos, backups, or world-readable environments.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
步骤 3: 设置权限
bash chmod 600 ~/.openclaw/config/clawrouter.json步骤 4: 重启 Gateway
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
步骤 3: 设置权限
bash chmod 600 ~/.openclaw/config/clawrouter.json步骤 4: 重启 Gateway
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
步骤 3: 设置权限
bash chmod 600 ~/.openclaw/config/clawrouter.json步骤 4: 重启 Gateway
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
This test request sends prompt content and an Authorization header to the local router endpoint, which is designed to forward requests onward to external providers. In the context of a routing/proxy product, that means user content and credentials may transit systems beyond the local machine, so the absence of an explicit privacy warning is security-relevant.
- Content
md tail -f ~/.clawrouter/logs/routing.log # 测试请求 curl http://localhost:8080/v1/chat/completions \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The guide recommends
kill -9 <PID>without warning about its forceful, destructive nature or the risk of targeting the wrong process. In an operational context, this can cause service disruption, data loss, or termination of unrelated workloads.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The troubleshooting step
cat ~/.openclaw/config/clawrouter.json | jq '.proxy.api_key'prints the secret directly to the terminal. This creates avoidable exposure through shell history captures, terminal logging, screen sharing, shoulder surfing, or CI transcripts.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The FAQ claims the system is '本地运行，数据不出境', but the rest of the guide clearly shows routing requests to external model services and handling API credentials for remote access. This can mislead users into sending sensitive prompts or data under a false assumption of locality and confidentiality.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file contains user-facing natural language that effectively forces a specific language/locale for understanding and use of the skill. The policy requires flagging language constraints when the skill does not offer user opt-in or explain that it is intentionally region-specific.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
2. 复制配置模板
bash # 创建配置目录 mkdir -p ~/.openclaw/config/{agents,skills,channels} mkdir -p ~/.openclaw/workspace/{memory,templates} # 复制核心配置模板
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
L145-L148 将该方案描述为“零风险重构”，且明确写出 “Phase 1 纯新增，不修改现有配置”；但文档中的实际操作包括生成并覆盖
~/.openclaw/openclaw.json（L271-L275）、同步修改~/agents/writer/SOUL.md（L279-L280），以及重启网关使变更生效（L126-L129）。这些行为明显会修改现有运行配置和记忆文件，因此与“纯新增、不修改现有配置”的说法相矛盾。- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
权限设置
bash chmod 755 ~/.openclaw/config chmod 644 ~/.openclaw/config/*.json chmod 600 ~/.openclaw/config/channels/feishu.json # 密钥文件更严格
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
权限设置
bash chmod 755 ~/.openclaw/config chmod 644 ~/.openclaw/config/*.json chmod 600 ~/.openclaw/config/channels/feishu.json # 密钥文件更严格