ClawHub
Back to skill

Security audit

OpenClaw Operator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent OpenClaw operations runbook, but its recommended watchdog script has unsafe filename handling that could let crafted local session files run code as the user.

Review and patch session-health-watchdog.sh before installing it as a recurring cron job. It is safest to run the scripts manually first, keep backups before any break-glass edits to OpenClaw state files, and only use the cron watchdog if the sessions directory is not writable by untrusted users or processes.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/session-health-watchdog.sh:34
Finding

Python Code Injection Through Crafted Session Filenames

Content
View full analysis
/dev/null || echo "unknown") ``` ### Technical Analysis The script derives `BASENAME` from a filesystem entry and directly embeds it inside Python source passed to `python3 -c`. Shell quoting around the command does not make the value safe once it becomes part of the generated Python program. A crafted `.jsonl` filename containing a single quote followed by valid Python syntax can terminate the intended Python string literal and introduce attacker-controlled statements. The injected statements execute whenever the watchdog examines a session file that meets the configured size threshold. Exploitation requires the attacker to be able to create or rename a sufficiently large `.jsonl` file under: ```text $HOME/.openclaw/agents/main/sessions ``` The recurring cron execution recommended by the project can provide a predictable execution trigger, but the cron mechanism itself is documented and is not a concealed persistence mechanism. ### Attack Path 1. The attacker obtains the ability to create or rename files in the OpenClaw sessions directory. 2. The attacker creates a `.jsonl` file of at least 5 MB, because only files meeting the session-size warning threshold reach the vulnerable Python invocation. 3. The file basename contains characters that close the Python string literal and inject valid Python code. 4. The user or the recommended scheduled watchdog invokes `session-health-watchdog.sh`. 5. The script discovers the crafted file, interpolates its basename into the `python3 -c` program, and ...[truncated 670 chars]
Remediation
View remediation
/dev/null`; log parsing failures without exposing sensitive data. 5. Add regression tests using filenames containing quotes, newlines, backslashes, and Python metacharacters. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/session-health-watchdog.sh:54
Finding

Python Code Injection Through Crafted Lock Filenames

Content
View full analysis
/dev/null || echo 0) if [[ "$LOCK_CREATED" -gt 0 ]]; then AGE=$(( NOW - LOCK_CREATED )) if [[ "$AGE" -ge "$LOCK_AGE_WARN_SEC" ]]; then LOCK_PID=$(python3 -c "import json; print(json.load(open('$lockfile')).get('pid','?'))" 2>/dev/null || echo "?") ``` ### Technical Analysis The full path stored in `lockfile` is inserted directly into two separate Python programs. Because the path is placed inside a single-quoted Python string literal without Python-level escaping, a lock filename containing a single quote and valid Python syntax can alter the generated program. The first invocation parses `createdAt`, and the second parses `pid`. The first invocation is reached for every discovered `*.lock` entry. The second is reached when the parsed timestamp indicates that the lock is at least ten minutes old. Shell quoting does not mitigate the vulnerability because the unsafe transformation occurs when data is embedded into Python source. Redirecting standard error and falling back to a default value also does not prevent injected statements from executing. ### Attack Path 1. The attacker obtains write access to `$HOME/.openclaw/agents/main/sessions`. 2. The attacker creates a filename ending in `.lock` whose path includes content designed to terminate the Python string and inject Python statements. 3. The attacker provides content that allows the generated program to remain syntactically valid, where necessary. 4. The watchdog runs ma ...[truncated 940 chars]
Remediation
View remediation
&2 continue } IFS='|' read -r LOCK_CREATED LOCK_PID <<< "$LOCK_DATA" ``` Additional hardening measures: 1. Verify each path with `[[ -f "$lockfile" && ! -L "$lockfile" ]]` before opening it. 2. Restrict permissions on the sessions directory so untrusted users cannot create lock entries. 3. Validate lock basenames against the expected session-ID format. 4. Open files defensively to reduce symbolic-link and replacement races where supported. 5. Add tests covering paths containing quotes, whitespace, newlines, and other metacharacters. 6. Remove all other cases where external data is interpolated into `python3 -c` source. ]]>

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents a comprehensive OpenClaw diagnostic and operations troubleshooting skill covering many failure modes and setup tasks. The supplied code only performs one specific check: measuring AGENTS.md size versus a bootstrap limit and reporting truncation risk. While this does relate to the declared bootstrap/AGENTS.md portion, it does not support the broad primary purpose claimed in the description. The code's actual purpose is materially narrower than the declared skill behavior, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description ends with "or any OpenClaw troubleshooting request," which is broad and lacks clear boundaries for when the skill should or should not activate. This can overlap with many ordinary support conversations about OpenClaw and may cause unintended invocation beyond the specific failure modes otherwise listed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md
AGENTS.md is likely truncated. Run `bootstrap-budget-check.sh` to see utilization. If above 90%, move sections to AGENTS-REFERENCE.md immediately.

### Tool writes fail with "Path escapes sandbox"
The agent tried to write to `/tmp/` or another path outside `~/.openclaw/workspace/`. All file operations must stay within the workspace sandbox. Teach the agent to use workspace-relative paths in AGENTS.md.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/failure-patterns.md (reported line 40)May include surrounding context.

md
**Fix:**
1. First try the safe path: restart gateway and use normal OpenClaw cron commands once the CLI responds again.
2. If the gateway is fully wedged and the bad cron immediately re-locks the system, use **break-glass recovery**: make a timestamped backup of `~/.openclaw/cron/jobs.json`, disable or remove only the offending job, and validate the file with `jq` before restart.
3. After recovery, re-create or fix the job using normal OpenClaw cron commands — do not leave the system depending on hand-edited state.
4. Restart gateway: `launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway`

**Prevention:** Run the cron lane validator before deploying any new cron job. The session-health-watchdog catches this automatically.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/failure-patterns.md (reported line 68)May include surrounding context.

md
**Fix:**
1. Archive the session: `cp ~/.openclaw/agents/main/sessions/<id>.jsonl ~/backups/`
2. Remove from registry: edit `~/.openclaw/agents/main/sessions/sessions.json` to remove the entry
3. The agent will create a fresh session on next message to that channel

**Prevention:** Monitor session sizes with the watchdog. For high-traffic channels, consider periodic session rotation.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/failure-patterns.md (reported line 206)May include surrounding context.

md
**Fix:**
1. Clear the oversized session (see Pattern 2)
2. Increase Node.js heap: add `--max-old-space-size=4096` to the launchd plist

**Prevention:** Keep sessions under 5MB. The watchdog catches this before OOM occurs.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/failure-patterns.md (reported line 271)May include surrounding context.

md
**Fix:**
1. Clear the oversized session (see Pattern 2)
2. Increase Node.js heap: add `--max-old-space-size=4096` to the launchd plist

**Prevention:** Keep sessions under 5MB. The watchdog catches this before OOM occurs.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/failure-patterns.md (reported line 214)May include surrounding context.

md
## 8. Sandbox Escape Writes

**Frequency:** 8+ `Path escapes sandbox` write failures
**Severity:** Low — write silently fails, agent retries or gives up

**Detection:**

Static analysis

No suspicious patterns detected.