ctct-security-patrol

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:35 AM UTC
• Version: 1.0.10

Overview

This is a real security-audit skill, but it performs broader local inspection and creates a persistent identifier in offline mode despite saying that identifier is only created for push mode.

Review this skill carefully before installing. Use it only if you are comfortable with broad local host inspection, persistent local reports and baselines, and optional OpenClaw cron scheduling. Do not use --push unless you trust auth.ctct.cn with your MAC address, hostname, persistent agent ID, installed Skill inventory, and audit summaries. The offline-mode agent_id behavior should be fixed before treating the local mode as privacy-preserving.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/openclaw-hybrid-audit-changeway.js:1146

Finding

Persistent device identifier created during offline scans contrary to the documented privacy boundary

Content

View full analysis

0 ? "warning" : "success"; const checkedCount = ITEM_SEQ - SKIP_COUNT; const passCount = checkedCount - RED_COUNT; let outputObj = { report_time: REPORT_TIME, status, red_item: RED_COUNT, checkedCount: checkedCount, passCount: passCount, agent_id: agentId, data: JSON_DATA }; const pushObj = { report_time: REPORT_TIME, status, red_item: RED_COUNT, red_count: RED_COUNT, checkedCount: checkedCount, passCount: passCount, agent_id: agentId, data: JSON_DATA.map(({ item, brief }) => ({ item, brief })) }; fs.writeFileSync( JSON_OUT_FILE, JSON.stringify(outputObj, null, 2), { encoding: 'utf-8', mode: 0o600 } ); if (!PUSH_ENABLED) { SUMMARY += `${COLORS.dim}────────────────────────────────────────────────────────────────────────${COLORS.reset}\n`; console.log(SUMMARY); console.log(`${COLORS.dim}详细审计报告已保存至: \`${REPORT_FILE}\`${COLORS.reset}`); console.log(`\n${COLORS.dim}当前为本地离线模式。如需参与全网威胁态势感知，请附加 --push 参数运行。${COLORS.reset}`); process.exit(0); return; } ``` ### Technical Analysis The Skill documentation st ...[truncated 2149 chars]

Remediation

View remediation

0 ? "warning" : "success"; const checkedCount = ITEM_SEQ - SKIP_COUNT; const passCount = checkedCount - RED_COUNT; if (!PUSH_ENABLED) { const offlineOutput = { report_time: REPORT_TIME, status, red_item: RED_COUNT, checkedCount, passCount, data: JSON_DATA }; fs.writeFileSync( JSON_OUT_FILE, JSON.stringify(offlineOutput, null, 2), { encoding: 'utf-8', mode: 0o600 } ); // Print the offline result and exit. return; } const agentId = generateAgentId(); // Build and submit push-mode data here. } ``` 2. Omit `agent_id` from all offline reports. 3. If a local correlation value is genuinely required, use a nonpersistent random identifier generated separately for each run and document it clearly. 4. Add an automated test asserting that a run without `--push` does not create `.agent-id`. 5. Add an automated test asserting that offline `report.json` does not contain `agent_id`. 6. Consider offering a documented command to delete an existing identifier and explain that deleting it resets remote correlation. 7. Ensure the implementation and `SKILL.md` privacy disclosures remain synchronized. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/openclaw-hybrid-audit-changeway.js:1065

Finding

Agent memory files are read without being included in the privacy disclosure

Content

View full analysis

{ if (!f.toLowerCase().endsWith('.md')) return false; return f.startsWith(todayStr) || f.startsWith(yestStr); }) .map(f => buildSafeChildPath(memoryDir, f)) .filter(Boolean) .sort(); } catch (e) { return []; } } const memoryDir = path.join(OC, 'workspace/memory'); const memFiles = getMemoryFilesForLast24h(memoryDir); let memCount = 0; for (const f of memFiles) { memCount += countMatchesInFile( f, platform === 'win32' ? /特权/gim : /sudo/gim ); } ``` The helper used above reads each selected file in full: ```js function countMatchesInFile(filePath, regex) { try { if (!(regex instanceof RegExp)) { return 0; } const content = fs.readFileSync(filePath, 'utf-8'); const matches = content.match(regex); return matches ? matches.length : 0; } catch (e) { return 0; } } ``` ### Technical Analysis The audit reads Markdown files from `~/.openclaw/workspace/memory` for the current and previous date, then searches their full contents for privilege-related words. Agent memory may contain conversation-derived information, operational history, user preferences, or other sensitive context. The privacy documentation discloses access to MAC addresses, hostnames, logs, temporary paths, and the installed Skill inventory, but it does not identify Agent memory as an accessed data source. As a result, a user cannot make a fully informed decision based ...[truncated 1893 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared behavior understates several sensitive actions: hashing credential files such as /etc/shadow, scanning workspace contents for secrets, reading process environment data, collecting system process/network snapshots, and sending host identifiers plus skill metadata during push mode. This creates a material consent gap: users may authorize a 'local audit' without understanding the breadth of host inspection and fingerprinting performed.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

macOS/Linux：shasum -a 256 scripts/openclaw-hybrid-audit-changeway.js

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

配置定时任务。配置完成后再继续第三步。

• 用户选 2（或回复"先跑一次"、"以后再说"、"跳过"等含义）→ 创建标记文件 ~/.openclaw/.audit-first-run（内容写 skipped），然后继续第三步。

关于定时任务的硬性要求：

• 必须使用 openclaw cron add 命令
• 禁止使用系统 crontab（crontab -e 等）
• 原因：系统 crontab 无法正确初始化 OpenClaw 环境，会导致执行失败
• ⚠️ 基础设施绑定说明：使用 openclaw cron 会将定时执行与 openclaw 基础设施绑定；如不希望依赖此基础设施，可不设置定时任务，改为手动执行
• cron 命令中严禁添加 --push 参数：定时任务只以本地离线模式运行，绝不自动向远端上报设备标识

第三步：询问检测模式

向用户发送以下消息，然后等待用户回复：

text

请选择检测模式：

1. 仅本地扫描（默认）— 不联网、不发送任何数据
   · �

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/cron-setup.md (reported line 16)May include surrounding context.

OpenClaw 安全巡检定时任务配置指南

⚠️ 重要警告（必读）

必须使用 openclaw cron，禁止使用系统 crontab

❌ 错误做法：使用 crontab -e 或编辑 /etc/crontab

✅ 正确做法：使用 OpenClaw 内置的 cron 系统

bash

openclaw cron add ...

原因：

1. 系统 crontab 无法正确初始化 OpenClaw 环境变量和会话
2. 会导致执行失败、权限问题或推送异常
3. openclaw cron 自动处理隔离会话、超时、推送等逻辑

快速配置

使用 OpenClaw Cron 注册

bash

openclaw cron add \
  --name "changeway-security-audit" \
  --description "每晚安全巡检" \
  --cron "45 23 * * *" \
  --tz "Asia/Shanghai" \
  --session "isolated" \
  --message "Run the security audit script: node <skill-path>/scripts/openclaw-hybrid-audit-changeway.js — then from the output extract and report ONLY these three items: (1) the l

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Including ~/.ssh/authorized_keys in the baseline causes the tool to read a security-sensitive authorization file. While it does not exfiltrate the contents directly, touching credential-adjacent files broadens access to sensitive material and should be tightly justified and disclosed.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 274)May include surrounding context.

js

if (platform === 'win32') {
        configFiles.push(
            path.join(process.env.PROGRAMDATA || 'C:\\ProgramData', 'ssh', 'sshd_config'),
            path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config')
        );
    } else {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This Unix branch similarly includes ~/.ssh/authorized_keys for content hashing, creating unnecessary access to sensitive authentication material. In a security-audit skill, this is contextually plausible but still dangerous when not clearly scoped and disclosed.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 280)May include surrounding context.

js

} else {
        configFiles.push(
            '/etc/ssh/sshd_config',
            path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config'),
            '/etc/passwd',
            '/etc/shadow'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

Hashing /etc/passwd extends the audit into system account inventory material outside the manifest’s stated scope. Although /etc/passwd is not secret like /etc/shadow, it still exposes account structure and represents broader host inspection than users may expect.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 282)May include surrounding context.

js

'/etc/ssh/sshd_config',
            path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config'),
            '/etc/passwd',
            '/etc/shadow'
        );
    }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Hashing /etc/shadow requires access to one of the most sensitive credential stores on Unix systems. Even without storing plaintext, the act of reading it unnecessarily grants credential-store access to the skill and materially increases risk if the tool is compromised or misused.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 283)May include surrounding context.

js

path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config'),
            '/etc/passwd',
            '/etc/shadow'
        );
    }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 658)May include surrounding context.

js

const permOCWin = checkWindowsFilePermission(path.join(OC, 'openclaw.json'));
    const sshdConfigPath = path.join(process.env.PROGRAMDATA || 'C:\\ProgramData', 'ssh', 'sshd_config');
    const permSshdWin = checkWindowsFilePermission(sshdConfigPath);
    const permAuthKeysWin = checkWindowsFilePermission(path.join(HOME, '.ssh/authorized_keys'));

    detail4 += `\n\n>>> 关键文件权限状态 (Windows ACL):
openclaw.json     : ${permOCWin} (预期: 无 Everyone/Users 写权限)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 675)May include surrounding context.

js

const permOCWin = checkWindowsFilePermission(path.join(OC, 'openclaw.json'));
    const sshdConfigPath = path.join(process.env.PROGRAMDATA || 'C:\\ProgramData', 'ssh', 'sshd_config');
    const permSshdWin = checkWindowsFilePermission(sshdConfigPath);
    const permAuthKeysWin = checkWindowsFilePermission(path.join(HOME, '.ssh/authorized_keys'));

    detail4 += `\n\n>>> 关键文件权限状态 (Windows ACL):
openclaw.json     : ${permOCWin} (预期: 无 Everyone/Users 写权限)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 1061)May include surrounding context.

js

// Event ID 4672 = 特权提升
    let psOut = spawnCmd('powershell', ['-NoProfile', '-Command',
        `(Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4672; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue | Measure-Object).Count`
    ]);
    sudoCount = parseInt(psOut, 10) || 0;
}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The skill declares no explicit tool scope despite requiring shell and environment access to inspect the host, read logs, enumerate installed skills, persist files, and optionally upload data. In a security-audit skill, broad undeclared capability is especially risky because users may invoke it expecting inspection, but the platform lacks a least-privilege contract to constrain what the skill can actually do.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language description states the skill is a China Telecom tool and the operational instructions throughout the file are written as mandatory Chinese user-facing prompts, while the trigger list also includes English. Because the skill can be invoked by English input such as "security audit" but does not offer a language choice or opt-in, it imposes a locale/language behavior without user selection.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases and activation condition are broad enough that routine requests like '检查安全' or generic security questions could unintentionally launch a host-inspecting audit workflow. Because this skill reads sensitive local data and can persist reports or set up cron tasks, accidental invocation materially increases privacy and operational risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

Listing sudo as a required callable command for audit operations indicates the skill may invoke privileged execution paths or depend on elevated reads. In the context of a host-auditing skill that already accesses sensitive files and logs, any sudo-capable path substantially increases blast radius if the skill is misused, modified, or triggered unintentionally.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

必需：Node.js v18+
    可选：openclaw CLI（用于定时任务管理；若使用定时巡检功能，需依赖 openclaw cron 命令）
    脚本调用的系统命令（缺失时对应检查项会 SKIP，不影响其他项）：
      macOS：find、lsof、netstat、ps、last、lastb、grep、awk、cat、sudo
      Linux：find、ss、lsof、ps、journalctl、last、lastb、grep、awk、cat、sudo
      Windows：wmic、netstat、tasklist、findstr

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The Linux command list again includes sudo, confirming elevated execution capability across platforms rather than an incidental mention. For a security tool, privileged inspection may be operationally understandable, but it still presents real risk because the manifest does not strictly confine what privileged actions are possible at the platform-permission level.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

可选：openclaw CLI（用于定时任务管理；若使用定时巡检功能，需依赖 openclaw cron 命令）
    脚本调用的系统命令（缺失时对应检查项会 SKIP，不影响其他项）：
      macOS：find、lsof、netstat、ps、last、lastb、grep、awk、cat、sudo
      Linux：find、ss、lsof、ps、journalctl、last、lastb、grep、awk、cat、sudo
      Windows：wmic、netstat、tasklist、findstr

security_notes: |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The skill explicitly supports creating persistent scheduled execution via openclaw cron. Even though it discourages --push in cron mode, persistence on a sensitive host-inspection skill increases risk by normalizing long-lived background execution, repeated local data collection, and future misuse if the skill or environment changes.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

**关于定时任务的硬性要求**：
- 必须使用 `openclaw cron add` 命令
- 禁止使用系统 crontab（`crontab -e` 等）
- 原因：系统 crontab 无法正确初始化 OpenClaw 环境，会导致执行失败
- ⚠️ 基础设施绑定说明：使用 `openclaw cron` 会将定时执行与 openclaw 基础设施绑定；如不希望依赖此基础设施，可不设置定时任务，改为手动执行
- **cron 命令中严禁添加 `--push` 参数**：定时任务只以本地离线模式运行，绝不自动向远端上报设备标识

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

md

✅ 安全。扫描了工作区的所有文件，没有发现明文写死的私钥或助记词。

### 13. 特权提权(Sudo)操作对账审计
✅ 安全。今天系统没有执行过 sudo 特权命令，Agent 的记忆记录也没有相关内容，两边对账一致，不存在偷偷提权的情况。

### 14. 生态组件恶意威胁情报扫描
✅ 安全。已列出本机安装的 54 个 Skill 组件，全部在安全名单中。（如果使用了完整检测模式且命中威胁情报，这里会显示具体的恶意组件和处置建议。）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cron-setup.md (reported line 7)May include surrounding context.

md

### 必须使用 `openclaw cron`，禁止使用系统 crontab

❌ **错误做法**：使用 `crontab -e` 或编辑 `/etc/crontab`


✅ **正确做法**：使用 OpenClaw 内置的 cron 系统

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cron-setup.md (reported line 127)May include surrounding context.

md

### 必须使用 `openclaw cron`，禁止使用系统 crontab

❌ **错误做法**：使用 `crontab -e` 或编辑 `/etc/crontab`


✅ **正确做法**：使用 OpenClaw 内置的 cron 系统

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cron-setup.md (reported line 123)May include surrounding context.

常见错误及修复

错误 1：使用了系统 crontab

现象：任务显示在 crontab -l 中，但执行失败或没有推送 修复：

bash

# 1. 删除系统 crontab 中的任务

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script's natural-language interface, status messages, and operational guidance are written in Chinese throughout, with no apparent language selection or opt-in mechanism. That creates a locale/language policy issue if the skill is expected to serve general users without forcing a specific language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The baseline generator reads and hashes highly sensitive files such as /etc/shadow, /etc/passwd, and SSH authorization/config files. Even though it stores hashes rather than plaintext, this still exceeds the declared scope and requires elevated access to credential-bearing files, creating unnecessary credential-access capability and privacy risk in a security tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script recursively scans broad sensitive roots including /etc, ~/.ssh, ~/.gnupg, /usr/local/bin, and the OpenClaw state tree for recent file changes. This is more expansive than the manifest description and can inventory sensitive filesystem structure and activity, increasing data exposure and user surprise even in offline mode.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 1049)May include surrounding context.

js

itemName = platform === 'win32' ? "特权提取操作对账审计" : "特权提权(Sudo)操作对账审计";
fs.appendFileSync(REPORT_FILE, platform === 'win32'
    ? `\n[13/14] 黄线操作交叉验证 (特权提取 vs Memory)`
    : `\n[13/14] 黄线操作交叉验证 (Sudo vs Memory)`);
let sudoCount = 0;
if (platform === 'linux') {
    ['/var/log/auth.log', '/var/log/secure'].forEach(logPath => {

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/openclaw-hybrid-audit-changeway.js:165