OpenClaw 集中配置管理系统

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:22 AM UTC
• Version: 1.2.0

Overview

The skill is mostly documentation and templates, but it recommends high-impact installation and configuration patterns that need careful review before use.

Install only if you are comfortable reviewing and tightening the templates first. Avoid the curl-to-bash installer, pin and verify any Docker/source installs, restrict Feishu access to approved users/groups, treat all API keys and bot tokens as secrets, use 600-style permissions for sensitive configs, and do not enable remote memorySearch unless you accept sending indexed memory content to that provider.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: ClawRouter 安装指南.md:16
• Finding: Mutable Remote Installer Is Piped Directly into Bash<![CDATA[ ## Vulnerability Details **File Location**: `ClawRouter Installation Guide.md` (`ClawRouter 安装指南.md`), line 16; `clawrouter.json Configuration Template.md` (`clawrouter.json 配置模板.md`), line 144 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://blockrun.ai/ClawRouter-update | bash ``` ### Technical Analysis The recommended installation command downloads content from a mutable external URL and immediately executes it through Bash. There is no separation between download and execution, no pinned release version, no cryptographic checksum, no publisher-signature verification, and no opportunity to inspect the downloaded script. TLS only protects the connection in transit. It does not protect users if the hosting account, domain, update infrastructure, or upstream release process is compromised. The command therefore allows the effective payload to change after this Skill has been reviewed. Executing a remote installer is not required for the Skill's declared configuration-management functionality and exceeds the minimum behavior necessary to provide a ClawRouter configuration template. ### Attack Path 1. An attacker compromises the `blockrun.ai` update endpoint, its deployment credentials, DNS configuration, or hosting infrastructure. 2. The attacker changes the response returned from `/ClawRouter-update`. 3. A user follows the Skill's recommended installation procedure. 4. `curl` downloads the attacker-controlled response. 5. The shell pipe passes the response directly to Bash without inspection or integrity validation. 6. Bash executes the payload with all privileges available to the invoking user. 7. The payload may read OpenClaw credentials, alter Agent instructions, replace wallet details, modify local programs, or install persistence. ### Impact Assessment The payload obtains arbitrary command execution under the invoking account. It can access al ...[truncated 294 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` installation instructions. 2. Direct users to a versioned release artifact hosted through a verifiable release channel. 3. Pin the installer to a specific release version or immutable commit. 4. Publish and verify a SHA-256 checksum and a cryptographic publisher signature. 5. Separate the process into explicit download, verification, inspection, and execution steps. 6. Run the installer with an unprivileged account and document the exact files and permissions it requires. 7. Prefer a package manager that supports signed metadata and reproducible version pinning. 8. Treat installation failure as fatal; never fall back to executing unverified content. ]]>

T08 · Insecure Dependencies

Error

• Location: ClawRouter 安装指南.md:30
• Finding: Unpinned Docker, Git, and npm Installation Paths Permit Supply-Chain Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `ClawRouter Installation Guide.md` (`ClawRouter 安装指南.md`), lines 30-54; `clawrouter.json Configuration Template.md` (`clawrouter.json 配置模板.md`), lines 150-162 **Vulnerability Type**: Unpinned third-party components and unsafe package lifecycle execution **Risk Level**: High ### Vulnerable Code ```bash docker run -d \ -p 8080:8080 \ -v ~/.clawrouter:/app/data \ --name clawrouter \ blockrun/clawrouter:latest ``` ```bash git clone https://github.com/blockrunai/ClawRouter.git cd ClawRouter npm install npm start ``` ### Technical Analysis The Docker instructions use the mutable `latest` tag rather than an immutable image digest. The source installation clones the repository's current default branch without pinning or verifying a signed commit or tag. The subsequent `npm install` may execute package lifecycle scripts from ClawRouter or its transitive dependencies. None of the installation paths verifies artifact provenance or integrity. A changed image tag, compromised repository, malicious package update, dependency confusion event, or compromised maintainer account can therefore introduce executable code after the Skill review. The Docker container also receives write access to `~/.clawrouter` through the bind mount. A compromised image could read, alter, or destroy router state stored there. ### Attack Path 1. An attacker compromises the Docker image, source repository, npm dependency, or a relevant maintainer account. 2. The attacker publishes malicious content under `blockrun/clawrouter:latest`, changes the default Git branch, or introduces a malicious npm lifecycle script. 3. A user follows one of the documented installation procedures. 4. Docker executes the mutable image, or `npm install` executes package lifecycle code. 5. The malicious component accesses the user's router data, network, API credentials, or other resources available to the process. 6. The component may persist by modifyi ...[truncated 485 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the Docker image by immutable digest, for example `image@sha256:...`, rather than using `latest`. 2. Verify image signatures and provenance before execution. 3. Pin source installation to a reviewed, signed release tag or exact commit hash. 4. Require a committed lockfile and use `npm ci` instead of unconstrained `npm install`. 5. Audit dependency and project lifecycle scripts; use `--ignore-scripts` where lifecycle execution is unnecessary. 6. Run dependency vulnerability and provenance checks before installation. 7. Make the container filesystem read-only where possible and mount only the minimum required directory. 8. Run the container as a non-root user, drop Linux capabilities, apply resource limits, and restrict outbound network access. 9. Document the expected artifact hashes so users can independently verify releases. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: 记忆系统配置模板.md:101
• Finding: Conversation-Derived Memory May Be Transmitted to a Third-Party Embedding Service<![CDATA[ ## Vulnerability Details **File Location**: `Memory System Configuration Template.md` (`记忆系统配置模板.md`), lines 30 and 101-108 **Vulnerability Type**: Undisclosed external processing of persistent Agent memory **Risk Level**: High ### Vulnerable Code ```text Enable memoryFlush so that, before compaction is triggered, the AI first writes important information to a file. ``` ```json { "memorySearch": { "enabled": true, "provider": "openai", "remote": { "baseUrl": "https://api.siliconflow.cn/v1", "apiKey": "{{SiliconFlow API Key}}" }, "model": "BAAI/bge-m3" } } ``` ### Technical Analysis The template encourages the Agent to persist important conversation details through `memoryFlush` and then configures semantic memory search through a remote embedding endpoint. Remote embedding generally requires transmitting the indexed text to the configured provider. The documentation does not require user consent before transmission, classify which memories may be indexed, redact credentials or personal information, or explain the provider's retention and deletion behavior. As a result, conversation-derived content written to memory may leave the local machine despite broader privacy assurances elsewhere in the project. The remote API key is also stored directly in the JSON configuration, increasing the sensitivity of that file. ### Attack Path 1. A conversation contains private user details, source code, internal project information, infrastructure data, or credentials. 2. `memoryFlush` selects some of that content as important and writes it into persistent memory files. 3. Memory indexing processes the files using the configured remote provider. 4. The memory text is transmitted to `https://api.siliconflow.cn/v1`. 5. The provider, its logs, a compromised account, or compromised infrastructure gains access to the submitted material. 6. Retained or exposed data may subsequently be used to reconstruct sensitive user or project ...[truncated 413 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to a local embedding model and require explicit opt-in before enabling a remote provider. 2. Clearly disclose that memory text may be transmitted outside the machine. 3. Add a pre-indexing redaction layer for credentials, tokens, personal data, private keys, and regulated information. 4. Permit users to select which files and fields may be indexed. 5. Exclude raw daily logs and other high-risk memory sources by default. 6. Document the provider's retention, training, geographic-processing, access-control, and deletion policies. 7. Encrypt local memory at rest and apply restrictive file permissions. 8. Store the remote API key through a protected secret manager or environment-based credential mechanism rather than plaintext JSON. 9. Provide commands to delete both local indexes and any remotely retained data. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: ClawRouter 安装指南.md:349
• Finding: Troubleshooting Command Exposes the Complete ClawRouter API Key<![CDATA[ ## Vulnerability Details **File Location**: `ClawRouter Installation Guide.md` (`ClawRouter 安装指南.md`), lines 349-352 **Vulnerability Type**: Plaintext credential disclosure **Risk Level**: Medium ### Vulnerable Code ```bash # 1. Check whether the API key is correct cat ~/.openclaw/config/clawrouter.json | jq '.proxy.api_key' ``` ### Technical Analysis The troubleshooting procedure prints the complete API key to standard output. Terminal output may remain in scrollback, be captured by screen recording, appear in support transcripts, or be collected by terminal and session-logging systems. Confirming that a credential exists does not require revealing its entire value. The command therefore exposes more sensitive information than is necessary for troubleshooting. ### Attack Path 1. A user experiences an authentication failure and follows the troubleshooting guide. 2. The command prints the complete API key. 3. The output is retained in terminal scrollback, a remote support session, a screenshot, a recording, or centralized shell logs. 4. Another person or process obtains the captured output. 5. The exposed key is reused to make unauthorized API requests. ### Impact Assessment An attacker who obtains the key may impersonate the user to the extent permitted by that credential. Potential impact includes unauthorized model requests, consumption of prepaid balance, access to associated router services, cost increases, and disruption through quota exhaustion. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never print the complete API key during diagnostics. 2. Check only whether the field is populated: ```bash jq -e '.proxy.api_key | type == "string" and length > 0' \ ~/.openclaw/config/clawrouter.json >/dev/null ``` 3. If identification is required, display only a short masked suffix. 4. Warn users not to paste credentials into support messages or screenshots. 5. Rotate any credential that has already been exposed through terminal output. 6. Prefer a secret manager or protected environment injection instead of storing the key directly in JSON. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: 配置模板合集（脱敏版）.md:178
• Finding: Open Messaging Policies Expose Tool-Enabled Agents to Untrusted Users<![CDATA[ ## Vulnerability Details **File Location**: `Sanitized Configuration Template Collection.md` (`配置模板合集（脱敏版）.md`), lines 178-182 **Vulnerability Type**: Overly permissive inbound access and plugin authorization **Risk Level**: High ### Vulnerable Code ```json { "enabled": true, "connection_mode": "websocket", "domain": "feishu", "group_policy": "open", "dm_policy": "open", "plugins_allow": ["feishu-openclaw-plugin"], "bots": [ ``` ### Technical Analysis Both group and direct-message policies are configured as `open`, while a Feishu plugin is explicitly allowed. The template does not provide sender, tenant, group, or account allowlists and does not show a least-privilege capability boundary for the plugin. Other parts of the project configure Agents with workspace access, persistent memory, model access, and actions such as content publication. Exposing such Agents to arbitrary inbound users expands the prompt-injection and unauthorized-use surface. An untrusted sender may be able to invoke costly model processing, influence persistent memory, or induce tool use depending on the runtime's enforcement controls. These open defaults are not required for centralized configuration management and violate least-privilege principles. ### Attack Path 1. An attacker discovers or is invited to an exposed Feishu bot or group. 2. Because direct-message and group policies are open, the attacker's message is accepted. 3. The attacker sends instructions designed to extract workspace information, alter Agent behavior, trigger expensive operations, or invoke plugin capabilities. 4. The Agent processes the message with its configured workspace, memory, model, and tool permissions. 5. If runtime confirmation and authorization controls are insufficient, the attacker causes unauthorized actions or obtains sensitive responses. ### Impact Assessment The accessible scope depends on the capabilities assigned to the affected Agent and plugin. Potential impac ...[truncated 321 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change group and direct-message policies to deny-by-default or allowlist-only modes. 2. Require explicit tenant, user, account, and group identifiers for authorization. 3. Separate public-facing Agents from Agents that can access private memories or sensitive workspaces. 4. Minimize plugin permissions and disable publishing, file access, and administrative capabilities unless expressly required. 5. Require user confirmation for actions that send data externally, publish content, change configuration, or incur significant cost. 6. Add per-user rate limits, request quotas, audit logs, and anomaly alerts. 7. Sanitize untrusted message content and ensure it cannot override system or Skill-level instructions. 8. Test authorization rules from unapproved accounts before production deployment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:205
• Finding: Broad Permission Commands Make Configuration Files World-Readable<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 205-208 and 258-262; `Sanitized Configuration Template Collection.md` (`配置模板合集（脱敏版）.md`), lines 284-288 **Vulnerability Type**: Excessive local read permissions on potentially sensitive configuration **Risk Level**: Medium ### Vulnerable Code ```bash chmod 755 ~/.openclaw/config chmod 644 ~/.openclaw/config/*.json chmod 600 ~/.openclaw/config/channels/feishu.json ``` The configuration loader also changes permissions while reading a file: ```bash load_config() { local mod="$1" local key="$2" local file="$CONFIG_DIR/$mod.json" chmod 644 "$file" 2>/dev/null /usr/local/bin/jq -r ".$key // empty" "$file" 2>/dev/null } ``` The consolidated template repeats the broad permission recommendation: ```bash chmod 755 ~/.openclaw/config chmod 755 ~/.openclaw/config/agents chmod 755 ~/.openclaw/config/channels chmod 644 ~/.openclaw/config/*.json chmod 644 ~/.openclaw/config/agents/*.json chmod 600 ~/.openclaw/config/channels/feishu.json ``` ### Technical Analysis Mode `644` allows every local account to read the affected configuration files. Mode `755` similarly allows other users to list or traverse the configuration directories when parent-directory permissions permit it. Although one Feishu configuration file receives mode `600`, the project also stores device identifiers, API endpoints, model settings, workspace locations, and potentially future credentials in other JSON files. The loader's `chmod 644` is particularly unsafe because a function intended only to read configuration has the side effect of weakening file permissions every time it runs. This behavior is unnecessary for configuration loading and violates least privilege. ### Attack Path 1. A user follows the documented permission commands, or a script invokes `load_config`. 2. One or more OpenClaw configuration files are changed to mode `644`. 3. Another local account or a compromised low-privilege process enu ...[truncated 627 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use mode `700` for sensitive configuration directories and `600` for all configuration files by default. 2. Remove `chmod` from the configuration loader; a read operation must not alter access controls. 3. Set restrictive permissions once during secure initialization. 4. Apply a restrictive process umask such as `077` before creating configuration or secret files. 5. Store credentials separately from non-sensitive configuration and use a secret manager where available. 6. Audit existing installations for group- or world-readable files: ```bash find ~/.openclaw/config -type f -perm /077 -print ``` 7. Validate file ownership and reject configuration files owned by unexpected users. 8. Avoid suppressing permission errors with `2>/dev/null`; report insecure ownership or modes clearly. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (48)

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# 1. 安装 ClawRouter
curl -fsSL https://blockrun.ai/ClawRouter-update | bash

# 2. 重启 OpenClaw Gateway
openclaw gateway restart

• Confidence: 99% confidence
• Finding: Fetching an installation script from a remote domain and executing it as part of setup is a classic supply-chain risk. Users are asked to trust both the remote host and the transport path with immediate code execution, making compromise of either highly impactful.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 1. 安装 ClawRouter
curl -fsSL https://blockrun.ai/ClawRouter-update | bash

# 2. 重启 OpenClaw Gateway
openclaw gateway restart

• Confidence: 99% confidence
• Finding: The `| bash` chain removes the user’s chance to inspect the downloaded content before it runs, compounding the risk of the external script fetch. In a configuration/operations skill, this is especially dangerous because users are likely to run commands verbatim on real systems.

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

External Script Fetching

High

• Category: Supply Chain

Content

**方式 1: 一键安装 (推荐)**
```bash
curl -fsSL https://blockrun.ai/ClawRouter-update | bash
openclaw gateway restart
```

• Confidence: 99% confidence
• Finding: This line explicitly fetches and executes an external script from `https://blockrun.ai/ClawRouter-update`, which is a classic supply-chain hazard. In the context of an agent skill intended to guide installation, this is more dangerous because users may copy-paste it verbatim and grant the script access to their workstation, credentials, configs, and local services.

Chaining Abuse

High

• Category: Tool Misuse

Content

**方式 1: 一键安装 (推荐)**
```bash
curl -fsSL https://blockrun.ai/ClawRouter-update | bash
openclaw gateway restart
```

• Confidence: 99% confidence
• Finding: The `| bash` chaining turns a network fetch into immediate shell execution with no review boundary, magnifying the risk of malicious or tampered content. Combined with the document's recommendation wording, it lowers user caution and increases the likelihood of unsafe execution.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

```bash
# 简单任务 - 使用便宜模型
openclaw agent --model gpt-4o-mini --message "提取 JSON"

# 复杂任务 - 使用 Claude
openclaw agent --model claude-sonnet-4 --message "架构设计"

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

openclaw agent --model gpt-4o-mini --message "提取 JSON"

# 复杂任务 - 使用 Claude
openclaw agent --model claude-sonnet-4 --message "架构设计"
```

---

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The template instructs the agent to automatically read multiple local context files, including USER.md and MEMORY.md, and explicitly says 'Don't ask permission. Just do it.' That removes user opt-in for potentially sensitive personal or historical data access and normalizes silent collection of context beyond the immediate task.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Safety

- Don't exfiltrate private data. Ever.
- Don't run destructive commands without asking.
- `trash` > `rm` (recoverable beats gone forever)
- When in doubt, ask.

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The guide recommends `curl ... | bash`, which downloads and immediately executes remote code without requiring the user to inspect or verify it. If the upstream site, network path, or update script is compromised, users can suffer arbitrary code execution on their machine.

External Transmission

Medium

• Category: Data Exfiltration

Content

openclaw gateway restart

# 3. 验证安装
curl http://localhost:8080/health
# 应返回：{"status": "ok"}
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide instructs users to place an API key into a config file but does not clearly warn that the key is sensitive or provide handling guidance beyond file permissions. Users may accidentally paste real credentials into shared terminals, screenshots, repos, backups, or world-readable environments.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 步骤 3: 设置权限

```bash
chmod 600 ~/.openclaw/config/clawrouter.json
```

### 步骤 4: 重启 Gateway

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 步骤 3: 设置权限

```bash
chmod 600 ~/.openclaw/config/clawrouter.json
```

### 步骤 4: 重启 Gateway

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 步骤 3: 设置权限

```bash
chmod 600 ~/.openclaw/config/clawrouter.json
```

### 步骤 4: 重启 Gateway

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

tail -f ~/.clawrouter/logs/routing.log

# 测试请求
curl http://localhost:8080/v1/chat/completions \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 78% confidence
• Finding: This test request sends prompt content and an Authorization header to the local router endpoint, which is designed to forward requests onward to external providers. In the context of a routing/proxy product, that means user content and credentials may transit systems beyond the local machine, so the absence of an explicit privacy warning is security-relevant.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The guide recommends `kill -9 <PID>` without warning about its forceful, destructive nature or the risk of targeting the wrong process. In an operational context, this can cause service disruption, data loss, or termination of unrelated workloads.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The troubleshooting step `cat ~/.openclaw/config/clawrouter.json | jq '.proxy.api_key'` prints the secret directly to the terminal. This creates avoidable exposure through shell history captures, terminal logging, screen sharing, shoulder surfing, or CI transcripts.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The FAQ claims the system is '本地运行，数据不出境', but the rest of the guide clearly shows routing requests to external model services and handling API credentials for remote access. This can mislead users into sending sensitive prompts or data under a false assumption of locality and confidentiality.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file contains user-facing natural language that effectively forces a specific language/locale for understanding and use of the skill. The policy requires flagging language constraints when the skill does not offer user opt-in or explain that it is intentionally region-specific.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 2. 复制配置模板
```bash
# 创建配置目录
mkdir -p ~/.openclaw/config/{agents,skills,channels}
mkdir -p ~/.openclaw/workspace/{memory,templates}

# 复制核心配置模板

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: L145-L148 将该方案描述为“零风险重构”，且明确写出 “Phase 1 纯新增，不修改现有配置”；但文档中的实际操作包括生成并覆盖 `~/.openclaw/openclaw.json`（L271-L275）、同步修改 `~/agents/writer/SOUL.md`（L279-L280），以及重启网关使变更生效（L126-L129）。这些行为明显会修改现有运行配置和记忆文件，因此与“纯新增、不修改现有配置”的说法相矛盾。

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 权限设置
```bash
chmod 755 ~/.openclaw/config
chmod 644 ~/.openclaw/config/*.json
chmod 600 ~/.openclaw/config/channels/feishu.json  # 密钥文件更严格
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 权限设置
```bash
chmod 755 ~/.openclaw/config
chmod 644 ~/.openclaw/config/*.json
chmod 600 ~/.openclaw/config/channels/feishu.json  # 密钥文件更严格
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.