Security audit

OpenClaw 沙盒测试系统

Security checks across malware telemetry and agentic risk

Overview

The skill is not clearly malicious, but its sandbox safety claims are stronger than the scripts support, and some commands can affect a live OpenClaw setup.

Review and edit the scripts before installing or running them. Treat apply-config.sh as production-impacting, verify backups yourself, avoid sourcing cleanup-env.sh, remove the hard-coded HOME path, disable any sandbox plugins you do not intend to test, and make sure you know how to stop the background sandbox gateway.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The script claims to clean environment contamination but actually overwrites the global HOME variable with a hard-coded user path. Changing HOME affects where many tools read configs, credentials, SSH keys, and state files, so this can redirect subsequent commands to the wrong account context and undermine the claimed safety boundary.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Hard-coding HOME to /Users/wh1ko is unsafe and unrelated to ordinary sandbox cleanup. If a user on another system runs this script, later commands may use another user's dotfiles, credential paths, Git configuration, or SSH material locations, causing privilege confusion, operational breakage, or accidental data exposure.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The script presents a reassuring '9 layers of protection' status, but most checks are hardcoded success messages rather than real validation. This can mislead users into trusting the sandbox as isolated and safe when key controls may be absent, resulting in unsafe configuration changes or execution in a non-isolated environment.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The skill is marketed as a 'zero-risk sandbox testing system', but this script explicitly targets the production configuration path in $HOME/.openclaw/openclaw.json and restarts the live gateway. That mismatch is dangerous because it can mislead users into running production-impacting actions under a false assumption of sandbox safety, increasing the chance of outage or unintended config changes.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The script claims backup/rollback safety properties, including automatic rollback on error, but no rollback handler exists. With 'set -e', failures after a partial manual config change or after restart can leave production in a broken state while the user incorrectly assumes recovery is automatic.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The script claims environment cleanup as a safety layer, but in practice it exports HOME to the sandbox path and only unsets OPENCLAW_HOME later. Leaving HOME modified can cause later commands in the same shell context to read from or write to the sandbox as if it were the user's real home, undermining the claimed isolation and creating confusing or unsafe side effects.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The comment states that the sandbox uses an empty plugin list, but the generated configuration explicitly allows and enables a plugin. In a security-sensitive sandboxing script, this mismatch is dangerous because operators may trust the stronger isolation claim while the runtime still loads plugin code that can access data or perform side effects.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document instructs users to run an apply script that changes the live OpenClaw configuration after sandbox testing, but it does not give an explicit warning that this step modifies production state. This increases the chance of an operator applying unreviewed or unintended changes to a real environment, especially because the earlier sandbox flow may create a false sense of safety.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.