openclaw-security-patrol

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:08 AM UTC
• Version: 1.0.8

Overview

This security-audit skill is mostly coherent, but it needs review because it performs broad local inspection, can run repeatedly via OpenClaw cron, and creates a persistent device identifier even in offline mode.

Install only if you are comfortable with a broad local security audit that reads sensitive system and OpenClaw areas and stores consolidated reports. Prefer local mode, avoid cron unless you really want recurring scans, do not use --push unless you trust auth.ctct.cn with host identifiers and Skill inventory, and note that this version creates a persistent agent_id even during offline scans.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Error

• Location: references/cron-setup.md:25

Finding

Optional recurring audit registers persistent Agent execution with an external notification path

Content

View full analysis

/scripts/openclaw-hybrid-audit-changeway.js — then from the output extract and report ONLY these three items: (1) the line containing PASS/FAIL/SKIP counts, (2) the report file path from the line starting with 'Detailed audit report saved to'. Do NOT include the full script output." \ --announce \ --channel \ --to \ --timeout-seconds 900 \ --thinking off ``` Related instructions also appear in `SKILL.md:116-130` and `SKILL.md:348-372`. ### Technical Analysis The first-run workflow encourages users to register an `openclaw cron` job that survives the current interaction and repeatedly starts an isolated Agent session. Each invocation executes a script that examines system configuration, logs, network listeners, processes, workspace content, Agent memory, and installed Skills. Scheduling is optional and the documentation prohibits adding `--push`, which reduces the telemetry risk. Nevertheless, recurring execution is not required for the declared one-time audit capability and materially expands the duration and frequency of access. The supplied command also enables `--announce`, `--channel`, and `--to`, creating a recurring external messaging path. Although `SKILL.md` later explains this behavior, the quick configuration template enables notifications directly. No conventional operating-system crontab is modified. Persistence is implemented through OpenClaw's own scheduler. ### Attack Path 1. The user invokes the Skill for an initial security audit. 2. The first-run workflow recommends automat ...[truncated 1139 chars]

Remediation

View remediation

`. 9. Add an expiration date or maximum-run count unless the user explicitly requests indefinite scheduling. 10. Continue enforcing the existing prohibition against `--push` in recurring jobs. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/openclaw-hybrid-audit-changeway.js:423

Finding

Default audit performs broad sensitive-system and Agent-state reconnaissance beyond minimum scope

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/openclaw-hybrid-audit-changeway.js:1254

Finding

Offline mode creates a persistent device identifier despite documentation limiting creation to push mode

Content

View full analysis

0 ? "warning" : "success"; const checkedCount = ITEM_SEQ - SKIP_COUNT; const passCount = checkedCount - RED_COUNT; let outputObj = { report_time: REPORT_TIME, status, red_item: RED_COUNT, checkedCount: checkedCount, passCount: passCount, agent_id: agentId, data: JSON_DATA }; fs.writeFileSync( JSON_OUT_FILE, JSON.stringify(outputObj, null, 2), { encoding: 'utf-8', mode: 0o600 } ); if (!PUSH_ENABLED) { process.exit(0); return; } } ``` ### Technical Analysis The privacy documentation states that the persistent `~/.openclaw/.agent-id` identifier is created only when the user explicitly selects `--push`. The implementation violates that boundary. `finalizeAndPushData()` invokes `generateAgentId()` before evaluating `PUSH_ENABLED`. As a result, every successfully completed offline scan creates or reuses `.agent-id` and includes it in the local JSON report. The identifier is therefore persisted without the specific consent required for push mode. This is a control-flow defect rather than covert transmission: the offline branch does not make a network request. Nevertheless, a later push reuses the identifier and allows subsequent submissions to be correlated with state created during an earlie ...[truncated 1070 chars]

Remediation

View remediation

other

Warning

• Location: scripts/openclaw-hybrid-audit-changeway.js:1167

Finding

Push mode transmits stable device and software inventory data that enables long-term host fingerprinting

Content

View full analysis

({ item, brief })) }; ``` The installed Skill inventory is submitted at `scripts/openclaw-hybrid-audit-changeway.js:1383-1391`: ```js const assessApiUrl = "https://auth.ctct.cn:10020/changeway-open/api/skills/assessment"; const assessApiPath = "/changeway-open/api/skills/assessment"; doSignedPost( assessApiUrl, assessApiPath, { data: skillMetaList }, (err, apiResRaw) => { // Response handl ...[truncated 2323 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (25)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger conditions are extremely broad, matching generic requests like '检查安全' or 'system security', which can cause this high-privilege skill to activate in many normal conversations. Because the skill reads sensitive host data, persists reports, and may steer users into cron setup or data-sharing flows, accidental invocation materially increases exposure.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

macOS/Linux：shasum -a 256 scripts/openclaw-hybrid-audit-changeway.js

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

配置定时任务。配置完成后再继续第三步。

• 用户选 2（或回复"先跑一次"、"以后再说"、"跳过"等含义）→ 创建标记文件 ~/.openclaw/.audit-first-run（内容写 skipped），然后继续第三步。

关于定时任务的硬性要求：

• 必须使用 openclaw cron add 命令
• 禁止使用系统 crontab（crontab -e 等）
• 原因：系统 crontab 无法正确初始化 OpenClaw 环境，会导致执行失败
• ⚠️ 基础设施绑定说明：使用 openclaw cron 会将定时执行与 openclaw 基础设施绑定；如不希望依赖此基础设施，可不设置定时任务，改为手动执行
• cron 命令中严禁添加 --push 参数：定时任务只以本地离线模式运行，绝不自动向远端上报设备标识

第三步：询问检测模式

向用户发送以下消息，然后等待用户回复：

text

请选择检测模式：

1. 仅本地扫描（默认）— 不联网、不发送任何数据
   · �

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/cron-setup.md (reported line 16)May include surrounding context.

OpenClaw 安全巡检定时任务配置指南

⚠️ 重要警告（必读）

必须使用 openclaw cron，禁止使用系统 crontab

❌ 错误做法：使用 crontab -e 或编辑 /etc/crontab

✅ 正确做法：使用 OpenClaw 内置的 cron 系统

bash

openclaw cron add ...

原因：

1. 系统 crontab 无法正确初始化 OpenClaw 环境变量和会话
2. 会导致执行失败、权限问题或推送异常
3. openclaw cron 自动处理隔离会话、超时、推送等逻辑

快速配置

使用 OpenClaw Cron 注册

bash

openclaw cron add \
  --name "changeway-security-audit" \
  --description "每晚安全巡检" \
  --cron "45 23 * * *" \
  --tz "Asia/Shanghai" \
  --session "isolated" \
  --message "Run the security audit script: node <skill-path>/scripts/openclaw-hybrid-audit-changeway.js — then from the output extract and report ONLY these three items: (1) the l

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 274)May include surrounding context.

js

if (platform === 'win32') {
        configFiles.push(
            path.join(process.env.PROGRAMDATA || 'C:\\ProgramData', 'ssh', 'sshd_config'),
            path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config')
        );
    } else {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 280)May include surrounding context.

js

if (platform === 'win32') {
        configFiles.push(
            path.join(process.env.PROGRAMDATA || 'C:\\ProgramData', 'ssh', 'sshd_config'),
            path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config')
        );
    } else {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 658)May include surrounding context.

js

if (platform === 'win32') {
        configFiles.push(
            path.join(process.env.PROGRAMDATA || 'C:\\ProgramData', 'ssh', 'sshd_config'),
            path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config')
        );
    } else {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 675)May include surrounding context.

js

if (platform === 'win32') {
        configFiles.push(
            path.join(process.env.PROGRAMDATA || 'C:\\ProgramData', 'ssh', 'sshd_config'),
            path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config')
        );
    } else {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Including /etc/passwd in baseline hashing extends the audit into direct reading of a system identity database. Although /etc/passwd is usually world-readable, hashing full contents of account databases and storing trust baselines inside a writable application state area broadens collection of sensitive system inventory beyond what many users would expect from a patrol tool.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 282)May include surrounding context.

js

'/etc/ssh/sshd_config',
            path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config'),
            '/etc/passwd',
            '/etc/shadow'
        );
    }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The script attempts to read and hash /etc/shadow during baseline generation on Unix-like systems. Accessing shadow password data is highly sensitive even if only for hashing, and a successful run would normalize possession of credential material inside the skill while creating unnecessary exposure if the baseline or process environment is later compromised.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 283)May include surrounding context.

js

path.join(HOME, '.ssh/authorized_keys'),
            path.join(HOME, '.ssh/config'),
            '/etc/passwd',
            '/etc/shadow'
        );
    }

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 1061)May include surrounding context.

js

// Event ID 4672 = 特权提升
    let psOut = spawnCmd('powershell', ['-NoProfile', '-Command',
        `(Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4672; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue | Measure-Object).Count`
    ]);
    sudoCount = parseInt(psOut, 10) || 0;
}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill performs sensitive local inspection, invokes shell-capable actions, reads system logs and installed skill inventories, and can optionally upload device-linked telemetry, yet it declares no explicit tool scope or permission boundary. That makes the effective privilege envelope opaque and increases the risk of overbroad execution in response to ordinary user requests.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Listing sudo as an expected system command indicates the skill may invoke privileged execution during audit operations. Even if intended for read-only inspection, introducing privilege escalation capability into a broadly triggered skill raises the risk of sensitive data over-collection or unintended privileged actions if the underlying script changes or is abused.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

必需：Node.js v18+
    可选：openclaw CLI（用于定时任务管理；若使用定时巡检功能，需依赖 openclaw cron 命令）
    脚本调用的系统命令（缺失时对应检查项会 SKIP，不影响其他项）：
      macOS：find、lsof、netstat、ps、last、lastb、grep、awk、cat、sudo
      Linux：find、ss、lsof、ps、journalctl、last、lastb、grep、awk、cat、sudo
      Windows：wmic、netstat、tasklist、findstr

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The Linux command set also includes sudo, again indicating potential privileged execution. In the context of a security-audit skill that already reads logs, host identifiers, and skill inventories, elevated access broadens the blast radius and can expose more sensitive artifacts than users expect.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

可选：openclaw CLI（用于定时任务管理；若使用定时巡检功能，需依赖 openclaw cron 命令）
    脚本调用的系统命令（缺失时对应检查项会 SKIP，不影响其他项）：
      macOS：find、lsof、netstat、ps、last、lastb、grep、awk、cat、sudo
      Linux：find、ss、lsof、ps、journalctl、last、lastb、grep、awk、cat、sudo
      Windows：wmic、netstat、tasklist、findstr

security_notes: |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill explicitly supports setting up recurring execution through openclaw cron, creating ongoing persistence on the host. Although framed as a convenience feature, persistence materially increases risk because the skill performs repeated sensitive inspection and local report retention over time.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md

**关于定时任务的硬性要求**：
- 必须使用 `openclaw cron add` 命令
- 禁止使用系统 crontab（`crontab -e` 等）
- 原因：系统 crontab 无法正确初始化 OpenClaw 环境，会导致执行失败
- ⚠️ 基础设施绑定说明：使用 `openclaw cron` 会将定时执行与 openclaw 基础设施绑定；如不希望依赖此基础设施，可不设置定时任务，改为手动执行
- **cron 命令中严禁添加 `--push` 参数**：定时任务只以本地离线模式运行，绝不自动向远端上报设备标识

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

md

✅ 安全。扫描了工作区的所有文件，没有发现明文写死的私钥或助记词。

### 13. 特权提权(Sudo)操作对账审计
✅ 安全。今天系统没有执行过 sudo 特权命令，Agent 的记忆记录也没有相关内容，两边对账一致，不存在偷偷提权的情况。

### 14. 生态组件恶意威胁情报扫描
✅ 安全。已列出本机安装的 54 个 Skill 组件，全部在安全名单中。（如果使用了完整检测模式且命中威胁情报，这里会显示具体的恶意组件和处置建议。）

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cron-setup.md (reported line 7)May include surrounding context.

md

### 必须使用 `openclaw cron`，禁止使用系统 crontab

❌ **错误做法**：使用 `crontab -e` 或编辑 `/etc/crontab`


✅ **正确做法**：使用 OpenClaw 内置的 cron 系统

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cron-setup.md (reported line 127)May include surrounding context.

md

### 必须使用 `openclaw cron`，禁止使用系统 crontab

❌ **错误做法**：使用 `crontab -e` 或编辑 `/etc/crontab`


✅ **正确做法**：使用 OpenClaw 内置的 cron 系统

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cron-setup.md (reported line 123)May include surrounding context.

常见错误及修复

错误 1：使用了系统 crontab

现象：任务显示在 crontab -l 中，但执行失败或没有推送 修复：

bash

# 1. 删除系统 crontab 中的任务

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file's natural-language comments and all user-facing status/output strings are written exclusively in Chinese, which effectively fixes the interaction locale without offering a language choice. Under the stated policy, forcing a specific language without user opt-in is a locale-policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest frames the skill as a security inspection tool that reads sensitive information and optionally uploads summaries, but the implementation includes a generalized subprocess dispatcher for many system commands such as PowerShell, netstat, lsof, ps, journalctl, and OpenClaw CLI commands. Spawning diverse host commands is a strong execution capability that should be explicitly declared because it materially expands what the skill can do on the endpoint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The audit skill is not purely observational: it can generate and write a configuration baseline file containing hashes of sensitive files, and later uses that state for trust decisions. A patrol/audit tool that silently establishes its own baseline can normalize a compromised state if run after tampering, weakening integrity guarantees.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/openclaw-hybrid-audit-changeway.js (reported line 1049)May include surrounding context.

js

itemName = platform === 'win32' ? "特权提取操作对账审计" : "特权提权(Sudo)操作对账审计";
fs.appendFileSync(REPORT_FILE, platform === 'win32'
    ? `\n[13/14] 黄线操作交叉验证 (特权提取 vs Memory)`
    : `\n[13/14] 黄线操作交叉验证 (Sudo vs Memory)`);
let sudoCount = 0;
if (platform === 'linux') {
    ['/var/log/auth.log', '/var/log/secure'].forEach(logPath => {

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

In --push mode, the script sends host-identifying metadata including MAC address, hostname, timestamp, nonce, a persistent agent_id, and summarized audit results to a remote service. The manifest says upload is optional and framed as 'summary data', but the implementation expands that scope with stable device identifiers, which materially increases privacy and tracking risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The telemetry path transmits host-identifying headers and a persistent agent identifier to a third-party endpoint, but the code itself does not provide a clear runtime notice describing those exact identifiers. Users enabling --push may reasonably expect report summaries, not device fingerprinting fields, creating a transparency and privacy gap.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/openclaw-hybrid-audit-changeway.js:165