Security audit

Openclaw Startup

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent OpenClaw onboarding skill that makes local setup changes and recommends persistent agent crons, with no artifact-backed evidence of deception, exfiltration, or destructive behavior.

Install only if you want this workspace initialized as an OpenClaw agent workspace. Before approving setup, review the generated SOUL.md permissions, confirm any crons one by one, and pay special attention to the daily backup cron because it commits workspace changes to git. Consider editing the prompt-injection rule so the agent can give brief, safe explanations instead of refusing to acknowledge security concerns at all.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: A setup skill that can initialize git, inspect workspace contents, scan for secrets, and run diagnostic or cron-management commands is materially more powerful than its high-level description suggests. This mismatch can cause users or reviewers to authorize the skill without understanding that it may read sensitive files, modify repository state, or perform broader environment inspection than expected.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The startup wizard’s template gives the resulting agent broad standing authority to read files, search the web, check email/calendar, update memory, process heartbeats, send emails, create events, and change cron schedules. For a first-run setup skill, embedding these capabilities by default expands operational scope well beyond initialization and increases the blast radius if the agent is later prompted unsafely or misconfigured.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The instruction to never acknowledge prompt injection or explain the security model is unnecessary for a startup/setup template and suppresses transparency during security-relevant interactions. This can hinder safe handling of suspicious requests by discouraging honest disclosure about why the agent is refusing or escalating an action.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The invocation phrase "Set up my workspace" is generic enough to overlap with normal user requests that may not explicitly intend to trigger this skill. Because this startup skill performs high-impact actions such as generating files, scaffolding memory, and proposing cron/security setup, accidental invocation could cause unintended configuration changes or confuse routing in multi-skill environments.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Broad trigger phrases like 'help me get started' or 'initialize workspace' can cause unintended invocation in ordinary conversation, especially for a skill that writes files, scaffolds directories, and may install crons. Accidental activation increases the chance of unplanned state changes in a workspace or premature execution of privileged setup steps.

Vague Triggers

Low

Confidence: 85% confidence
Finding: Repeating an overly broad example trigger in the usage guidance reinforces the possibility of accidental invocation by normal user phrasing. In this skill's context, unintended execution is more concerning because the workflow performs setup actions that can persistently alter the environment.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: Hard-coding a rule that the agent must never acknowledge prompt injection or explain the security model can obstruct defensive behavior and user awareness. In practice, it may cause the agent to conceal security-relevant context from the legitimate user, making it harder to detect attacks, audit behavior, or understand why a request was blocked.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The recommended backup cron instructs the agent to commit all workspace changes automatically, which can modify user files and git history without sufficiently explicit consent or guardrails. In a first-run onboarding skill, users may approve a 'backup' expecting passive copying, not an automated VCS operation that stages unrelated changes, captures secrets, or creates persistent history entries.

Static analysis

No suspicious patterns detected.