openclaw-security-patrol

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:08 AM UTC
• Version: 1.0.8

Overview

This security-audit skill is mostly coherent, but it needs review because it performs broad local inspection, can run repeatedly via OpenClaw cron, and creates a persistent device identifier even in offline mode.

Install only if you are comfortable with a broad local security audit that reads sensitive system and OpenClaw areas and stores consolidated reports. Prefer local mode, avoid cron unless you really want recurring scans, do not use --push unless you trust auth.ctct.cn with host identifiers and Skill inventory, and note that this version creates a persistent agent_id even during offline scans.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Error

• Location: references/cron-setup.md:25
• Finding: Optional recurring audit registers persistent Agent execution with an external notification path<![CDATA[ ## Vulnerability Details **File Location**: `references/cron-setup.md:25-39` **Vulnerability Type**: Persistent scheduled task registration **Risk Level**: High ### Vulnerable Code ```bash openclaw cron add \ --name "changeway-security-audit" \ --description "Nightly security audit" \ --cron "45 23 * * *" \ --tz "Asia/Shanghai" \ --session "isolated" \ --message "Run the security audit script: node <skill-path>/scripts/openclaw-hybrid-audit-changeway.js — then from the output extract and report ONLY these three items: (1) the line containing PASS/FAIL/SKIP counts, (2) the report file path from the line starting with 'Detailed audit report saved to'. Do NOT include the full script output." \ --announce \ --channel <channel> \ --to <your-chat-id> \ --timeout-seconds 900 \ --thinking off ``` Related instructions also appear in `SKILL.md:116-130` and `SKILL.md:348-372`. ### Technical Analysis The first-run workflow encourages users to register an `openclaw cron` job that survives the current interaction and repeatedly starts an isolated Agent session. Each invocation executes a script that examines system configuration, logs, network listeners, processes, workspace content, Agent memory, and installed Skills. Scheduling is optional and the documentation prohibits adding `--push`, which reduces the telemetry risk. Nevertheless, recurring execution is not required for the declared one-time audit capability and materially expands the duration and frequency of access. The supplied command also enables `--announce`, `--channel`, and `--to`, creating a recurring external messaging path. Although `SKILL.md` later explains this behavior, the quick configuration template enables notifications directly. No conventional operating-system crontab is modified. Persistence is implemented through OpenClaw's own scheduler. ### Attack Path 1. The user invokes the Skill for an initial security audit. 2. The first-run workflow recommends automat ...[truncated 1139 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove scheduled-task enrollment from the first-run audit flow. 2. Present scheduling as a separate, advanced feature after a successful manual scan. 3. Display the fully resolved command, absolute script path, schedule, permissions, and notification destination before registration. 4. Require a separate confirmation immediately before executing `openclaw cron add`. 5. Disable `--announce`, `--channel`, and `--to` by default; require separate consent for external notifications. 6. Pin or verify the script hash before every scheduled execution so later file replacement cannot silently change task behavior. 7. Restrict the scheduled profile to a reduced set of non-invasive checks. 8. Document and offer a one-command removal procedure using `openclaw cron remove --id <job-id>`. 9. Add an expiration date or maximum-run count unless the user explicitly requests indefinite scheduling. 10. Continue enforcing the existing prohibition against `--push` in recurring jobs. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/openclaw-hybrid-audit-changeway.js:423
• Finding: Default audit performs broad sensitive-system and Agent-state reconnaissance beyond minimum scope<![CDATA[ ## Vulnerability Details **File Location**: `scripts/openclaw-hybrid-audit-changeway.js:423-430` **Vulnerability Type**: Excessive access to sensitive system and Agent data **Risk Level**: Medium ### Vulnerable Code ```js let SENSITIVE_ROOTS; if (platform === 'win32') { SENSITIVE_ROOTS = [ OC, path.join(HOME, '.ssh'), path.join(HOME, '.gnupg'), path.join(process.env.PROGRAMDATA || 'C:\\ProgramData', 'ssh') ]; } else { SENSITIVE_ROOTS = [ OC, '/etc', path.join(HOME, '.ssh'), path.join(HOME, '.gnupg'), '/usr/local/bin' ]; } ``` The broader access pattern also includes: ```js const environPath = `/proc/${gwPid}/environ`; const environData = fs.readFileSync(environPath, 'utf-8'); const envEntries = environData.split('\0').filter(Boolean); ``` ```js let scanRoot = path.join(OC, 'workspace'); // ... scanDir(scanRoot); ``` ```js const memoryDir = path.join(OC, 'workspace/memory'); const memFiles = getMemoryFilesForLast24h(memoryDir); ``` These related operations occur at `scripts/openclaw-hybrid-audit-changeway.js:535-543`, `1009-1039`, and `1066-1090`. ### Technical Analysis The default offline mode recursively enumerates recently modified files under all of `/etc`, the user's SSH and GPG directories, OpenClaw state, and `/usr/local/bin`. It additionally attempts to read another process's environment block, recursively reads non-binary workspace files to search for private-key or mnemonic patterns, and reads recent Agent memory files to count privileged-operation references. These checks are broadly related to security auditing and are partially disclosed. However, they exceed the minimum access necessary for a basic OpenClaw security-health assessment. The combination provides a detailed map of sensitive files, system changes, process configuration, Agent activity, installed tooling, and potentially sensitive workspace content. Although environment-variable va ...[truncated 1746 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Limit default scanning to OpenClaw-owned configuration and report directories. 2. Move `.ssh`, `.gnupg`, `/etc`, `/usr/local/bin`, process-environment, workspace-content, and Agent-memory checks behind separately named opt-in flags. 3. Explain each invasive check and request granular consent before access. 4. Do not read complete process environment blocks. Prefer a gateway diagnostic endpoint that returns only an approved list of variable names. 5. Exclude Agent memory from the default audit; use explicit structured audit events instead of searching natural-language memory files. 6. For workspace DLP checks, scan only user-selected paths and enforce strict file-size, type, depth, and count limits. 7. Store aggregate counts rather than sensitive absolute paths whenever possible. 8. Apply `0700` to the report directory and `0600` to every report and baseline file, including files subsequently overwritten. 9. Implement report expiration and secure deletion controls. 10. Run the scheduled profile with a narrower permission set than interactive, explicitly approved deep scans. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/openclaw-hybrid-audit-changeway.js:1254
• Finding: Offline mode creates a persistent device identifier despite documentation limiting creation to push mode<![CDATA[ ## Vulnerability Details **File Location**: `scripts/openclaw-hybrid-audit-changeway.js:1254-1287` **Vulnerability Type**: Privacy-boundary violation and unnecessary persistent state **Risk Level**: Medium ### Vulnerable Code ```js function generateAgentId() { const idPath = path.join(OC, '.agent-id'); if (fs.existsSync(idPath)) { return fs.readFileSync(idPath, 'utf-8').trim(); } const id = crypto.randomUUID(); try { fs.writeFileSync(idPath, id, { mode: 0o600 }); } catch (e) {} return id; } function finalizeAndPushData() { const agentId = generateAgentId(); const status = RED_COUNT > 0 ? "warning" : "success"; const checkedCount = ITEM_SEQ - SKIP_COUNT; const passCount = checkedCount - RED_COUNT; let outputObj = { report_time: REPORT_TIME, status, red_item: RED_COUNT, checkedCount: checkedCount, passCount: passCount, agent_id: agentId, data: JSON_DATA }; fs.writeFileSync( JSON_OUT_FILE, JSON.stringify(outputObj, null, 2), { encoding: 'utf-8', mode: 0o600 } ); if (!PUSH_ENABLED) { process.exit(0); return; } } ``` ### Technical Analysis The privacy documentation states that the persistent `~/.openclaw/.agent-id` identifier is created only when the user explicitly selects `--push`. The implementation violates that boundary. `finalizeAndPushData()` invokes `generateAgentId()` before evaluating `PUSH_ENABLED`. As a result, every successfully completed offline scan creates or reuses `.agent-id` and includes it in the local JSON report. The identifier is therefore persisted without the specific consent required for push mode. This is a control-flow defect rather than covert transmission: the offline branch does not make a network request. Nevertheless, a later push reuses the identifier and allows subsequent submissions to be correlated with state created during an earlie ...[truncated 1070 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Move `generateAgentId()` entirely inside the `PUSH_ENABLED` branch. 2. Do not include `agent_id` in offline JSON output. 3. Generate the identifier only after the user has explicitly consented to the current push operation. 4. Provide a command or interface to delete the persistent identifier and request deletion of server-side history. 5. Consider replacing the stable identifier with an ephemeral per-request identifier. 6. Add a migration that detects and removes identifiers created by previous offline runs unless the user opts to retain them. 7. Add automated tests asserting that an offline run: - Makes no network requests. - Does not create `.agent-id`. - Does not include an `agent_id` field in reports. 8. Update privacy documentation only after implementation and tests match the stated behavior. ]]>

other

Warning

• Location: scripts/openclaw-hybrid-audit-changeway.js:1167
• Finding: Push mode transmits stable device and software inventory data that enables long-term host fingerprinting<![CDATA[ ## Vulnerability Details **File Location**: `scripts/openclaw-hybrid-audit-changeway.js:1167-1210` **Vulnerability Type**: Privacy-sensitive telemetry and durable device fingerprinting **Risk Level**: Medium ### Vulnerable Code ```js function doSignedPost(apiUrl, apiPath, bodyObj, callback) { const mac = getActiveMac(); const hostname = os.hostname(); const timestamp = Math.floor(Date.now() / 1000).toString(); const nonce = Math.random().toString(36).substring(2, 10); const method = "POST"; const bodyStr = JSON.stringify(bodyObj); const signContent = mac + "\n" + hostname + "\n" + timestamp + "\n" + nonce; const sign = crypto.createHash("sha256") .update(signContent, 'utf8') .digest("hex"); const options = { hostname: urlObj.hostname, port: port, path: apiPath, method: method, timeout: 10000, headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(bodyStr), 'X-MAC': mac, 'X-HOSTNAME': hostname, 'X-TIMESTAMP': timestamp, 'X-NONCE': nonce, 'X-SIGN': sign } }; ``` The transmitted audit object is constructed at `scripts/openclaw-hybrid-audit-changeway.js:1268-1278`: ```js const pushObj = { report_time: REPORT_TIME, status, red_item: RED_COUNT, red_count: RED_COUNT, checkedCount: checkedCount, passCount: passCount, agent_id: agentId, data: JSON_DATA.map(({ item, brief }) => ({ item, brief })) }; ``` The installed Skill inventory is submitted at `scripts/openclaw-hybrid-audit-changeway.js:1383-1391`: ```js const assessApiUrl = "https://auth.ctct.cn:10020/changeway-open/api/skills/assessment"; const assessApiPath = "/changeway-open/api/skills/assessment"; doSignedPost( assessApiUrl, assessApiPath, { data: skillMetaList }, (err, apiResRaw) => { // Response handl ...[truncated 2323 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove MAC address and hostname from request headers and signature input. 2. Replace the persistent agent ID with an ephemeral, per-request identifier unless durable history is separately requested. 3. Provide a complete payload preview immediately before transmission. 4. Allow users to select which Skill fields and audit summaries are uploaded. 5. Send pseudonymous aggregate indicators instead of a complete installed-Skill inventory. 6. Publish retention periods, access controls, deletion procedures, and incident-response commitments for the remote service. 7. Provide a local-only threat-intelligence option using signed, downloadable indicator databases. 8. If request authentication is required, use a documented cryptographic protocol with a protected credential rather than an unkeyed SHA-256 digest. 9. Continue prohibiting `--push` in scheduled jobs. 10. Add tests proving that detailed report fields, logs, file paths, environment values, and detected secret material can never enter telemetry payloads. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (25)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The trigger conditions are extremely broad, matching generic requests like '检查安全' or 'system security', which can cause this high-privilege skill to activate in many normal conversations. Because the skill reads sensitive host data, persists reports, and may steer users into cron setup or data-sharing flows, accidental invocation materially increases exposure.

Ae1

High

• Category: analysis-evasion

Content

macOS/Linux：shasum -a 256 scripts/openclaw-hybrid-audit-changeway.js

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

配置定时任务。配置完成后再继续第三步。
- 用户选 **2**（或回复"先跑一次"、"以后再说"、"跳过"等含义）→ 创建标记文件 `~/.openclaw/.audit-first-run`（内容写 `skipped`），然后继续第三步。

**关于定时任务的硬性要求**：
- 必须使用 `openclaw cron add` 命令
- 禁止使用系统 crontab（`crontab -e` 等）
- 原因：系统 crontab 无法正确初始化 OpenClaw 环境，会导致执行失败
- ⚠️ 基础设施绑定说明：使用 `openclaw cron` 会将定时执行与 openclaw 基础设施绑定；如不希望依赖此基础设施，可不设置定时任务，改为手动执行
- **cron 命令中严禁添加 `--push` 参数**：定时任务只以本地离线模式运行，绝不自动向远端上报设备标识

## 第三步：询问检测模式

向用户发送以下消息，然后等待用户回复：

```
请选择检测模式：

1. 仅本地扫描（默认）— 不联网、不发送任何数据
   · �

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

# OpenClaw 安全巡检定时任务配置指南

## ⚠️ 重要警告（必读）

### 必须使用 `openclaw cron`，禁止使用系统 crontab

❌ **错误做法**：使用 `crontab -e` 或编辑 `/etc/crontab`


✅ **正确做法**：使用 OpenClaw 内置的 cron 系统
```bash
openclaw cron add ...
```

**原因**：
1. 系统 crontab 无法正确初始化 OpenClaw 环境变量和会话
2. 会导致执行失败、权限问题或推送异常
3. `openclaw cron` 自动处理隔离会话、超时、推送等逻辑

## 快速配置

### 使用 OpenClaw Cron 注册

```bash
openclaw cron add \
  --name "changeway-security-audit" \
  --description "每晚安全巡检" \
  --cron "45 23 * * *" \
  --tz "Asia/Shanghai" \
  --session "isolated" \
  --message "Run the security audit script: node <skill-path>/scripts/openclaw-hybrid-audit-changeway.js — then from the output extract and report ONLY these three items: (1) the l

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Credential Access

High

• Category: Privilege Escalation

Content

if (platform === 'win32') {
        configFiles.push(
            path.join(process.env.PROGRAMDATA || 'C:\\ProgramData', 'ssh', 'sshd_config'),
            path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config')
        );
    } else {

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

if (platform === 'win32') {
        configFiles.push(
            path.join(process.env.PROGRAMDATA || 'C:\\ProgramData', 'ssh', 'sshd_config'),
            path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config')
        );
    } else {

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

if (platform === 'win32') {
        configFiles.push(
            path.join(process.env.PROGRAMDATA || 'C:\\ProgramData', 'ssh', 'sshd_config'),
            path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config')
        );
    } else {

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

if (platform === 'win32') {
        configFiles.push(
            path.join(process.env.PROGRAMDATA || 'C:\\ProgramData', 'ssh', 'sshd_config'),
            path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config')
        );
    } else {

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

'/etc/ssh/sshd_config',
            path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config'),
            '/etc/passwd',
            '/etc/shadow'
        );
    }

• Confidence: 88% confidence
• Finding: Including /etc/passwd in baseline hashing extends the audit into direct reading of a system identity database. Although /etc/passwd is usually world-readable, hashing full contents of account databases and storing trust baselines inside a writable application state area broadens collection of sensitive system inventory beyond what many users would expect from a patrol tool.

Credential Access

High

• Category: Privilege Escalation

Content

path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config'),
            '/etc/passwd',
            '/etc/shadow'
        );
    }

• Confidence: 97% confidence
• Finding: The script attempts to read and hash /etc/shadow during baseline generation on Unix-like systems. Accessing shadow password data is highly sensitive even if only for hashing, and a successful run would normalize possession of credential material inside the skill while creating unnecessary exposure if the baseline or process environment is later compromised.

Chaining Abuse

High

• Category: Tool Misuse

Content

// Event ID 4672 = 特权提升
    let psOut = spawnCmd('powershell', ['-NoProfile', '-Command',
        `(Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4672; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue | Measure-Object).Count`
    ]);
    sudoCount = parseInt(psOut, 10) || 0;
}

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill performs sensitive local inspection, invokes shell-capable actions, reads system logs and installed skill inventories, and can optionally upload device-linked telemetry, yet it declares no explicit tool scope or permission boundary. That makes the effective privilege envelope opaque and increases the risk of overbroad execution in response to ordinary user requests.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

必需：Node.js v18+
    可选：openclaw CLI（用于定时任务管理；若使用定时巡检功能，需依赖 openclaw cron 命令）
    脚本调用的系统命令（缺失时对应检查项会 SKIP，不影响其他项）：
      macOS：find、lsof、netstat、ps、last、lastb、grep、awk、cat、sudo
      Linux：find、ss、lsof、ps、journalctl、last、lastb、grep、awk、cat、sudo
      Windows：wmic、netstat、tasklist、findstr

• Confidence: 84% confidence
• Finding: Listing sudo as an expected system command indicates the skill may invoke privileged execution during audit operations. Even if intended for read-only inspection, introducing privilege escalation capability into a broadly triggered skill raises the risk of sensitive data over-collection or unintended privileged actions if the underlying script changes or is abused.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

可选：openclaw CLI（用于定时任务管理；若使用定时巡检功能，需依赖 openclaw cron 命令）
    脚本调用的系统命令（缺失时对应检查项会 SKIP，不影响其他项）：
      macOS：find、lsof、netstat、ps、last、lastb、grep、awk、cat、sudo
      Linux：find、ss、lsof、ps、journalctl、last、lastb、grep、awk、cat、sudo
      Windows：wmic、netstat、tasklist、findstr

security_notes: |

• Confidence: 84% confidence
• Finding: The Linux command set also includes sudo, again indicating potential privileged execution. In the context of a security-audit skill that already reads logs, host identifiers, and skill inventories, elevated access broadens the blast radius and can expose more sensitive artifacts than users expect.

Session Persistence

Medium

• Category: Rogue Agent

Content

**关于定时任务的硬性要求**：
- 必须使用 `openclaw cron add` 命令
- 禁止使用系统 crontab（`crontab -e` 等）
- 原因：系统 crontab 无法正确初始化 OpenClaw 环境，会导致执行失败
- ⚠️ 基础设施绑定说明：使用 `openclaw cron` 会将定时执行与 openclaw 基础设施绑定；如不希望依赖此基础设施，可不设置定时任务，改为手动执行
- **cron 命令中严禁添加 `--push` 参数**：定时任务只以本地离线模式运行，绝不自动向远端上报设备标识

• Confidence: 93% confidence
• Finding: The skill explicitly supports setting up recurring execution through openclaw cron, creating ongoing persistence on the host. Although framed as a convenience feature, persistence materially increases risk because the skill performs repeated sensitive inspection and local report retention over time.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

✅ 安全。扫描了工作区的所有文件，没有发现明文写死的私钥或助记词。

### 13. 特权提权(Sudo)操作对账审计
✅ 安全。今天系统没有执行过 sudo 特权命令，Agent 的记忆记录也没有相关内容，两边对账一致，不存在偷偷提权的情况。

### 14. 生态组件恶意威胁情报扫描
✅ 安全。已列出本机安装的 54 个 Skill 组件，全部在安全名单中。（如果使用了完整检测模式且命中威胁情报，这里会显示具体的恶意组件和处置建议。）

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 必须使用 `openclaw cron`，禁止使用系统 crontab

❌ **错误做法**：使用 `crontab -e` 或编辑 `/etc/crontab`


✅ **正确做法**：使用 OpenClaw 内置的 cron 系统

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

### 必须使用 `openclaw cron`，禁止使用系统 crontab

❌ **错误做法**：使用 `crontab -e` 或编辑 `/etc/crontab`


✅ **正确做法**：使用 OpenClaw 内置的 cron 系统

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## 常见错误及修复

### 错误 1：使用了系统 crontab
**现象**：任务显示在 `crontab -l` 中，但执行失败或没有推送
**修复**：
```bash
# 1. 删除系统 crontab 中的任务

• Confidence: 85% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file's natural-language comments and all user-facing status/output strings are written exclusively in Chinese, which effectively fixes the interaction locale without offering a language choice. Under the stated policy, forcing a specific language without user opt-in is a locale-policy violation unless clearly justified as region-specific.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The manifest frames the skill as a security inspection tool that reads sensitive information and optionally uploads summaries, but the implementation includes a generalized subprocess dispatcher for many system commands such as PowerShell, netstat, lsof, ps, journalctl, and OpenClaw CLI commands. Spawning diverse host commands is a strong execution capability that should be explicitly declared because it materially expands what the skill can do on the endpoint.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The audit skill is not purely observational: it can generate and write a configuration baseline file containing hashes of sensitive files, and later uses that state for trust decisions. A patrol/audit tool that silently establishes its own baseline can normalize a compromised state if run after tampering, weakening integrity guarantees.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

itemName = platform === 'win32' ? "特权提取操作对账审计" : "特权提权(Sudo)操作对账审计";
fs.appendFileSync(REPORT_FILE, platform === 'win32'
    ? `\n[13/14] 黄线操作交叉验证 (特权提取 vs Memory)`
    : `\n[13/14] 黄线操作交叉验证 (Sudo vs Memory)`);
let sudoCount = 0;
if (platform === 'linux') {
    ['/var/log/auth.log', '/var/log/secure'].forEach(logPath => {

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: In --push mode, the script sends host-identifying metadata including MAC address, hostname, timestamp, nonce, a persistent agent_id, and summarized audit results to a remote service. The manifest says upload is optional and framed as 'summary data', but the implementation expands that scope with stable device identifiers, which materially increases privacy and tracking risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The telemetry path transmits host-identifying headers and a persistent agent identifier to a third-party endpoint, but the code itself does not provide a clear runtime notice describing those exact identifiers. Users enabling --push may reasonably expect report summaries, not device fingerprinting fields, creating a transparency and privacy gap.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/openclaw-hybrid-audit-changeway.js:165