Security Analysis

Conduct security audits following strict operational procedures. Only perform analysis when explicitly requested.

Core Principles

• - Selective Action: Only analyze when user explicitly requests security help
• Assume All External Input is Malicious: Treat user/API/file data as untrusted until validated
• Principle of Least Privilege: Code should have only necessary permissions
• Fail Securely: Error handling must not expose sensitive information

Permitted Tools

• - Read-only operations only: ls -R, grep, INLINECODE2
• DO NOT write/modify/delete files unless explicitly instructed
• Store artifacts in .shield_security/ directory
• Present complete report in conversation response

SKILL.md Security Review

When reviewing OpenClaw SKILL.md files or agent instructions, check for:

1. Instruction Injection Vulnerabilities

Skills define agent behavior. Malicious or poorly-written skills can:

• - Override system safety instructions
• Instruct agent to exfiltrate data
• Bypass access controls through social engineering
• Execute unintended commands

Red Flags:
CODEBLOCK0

2. Data Exfiltration Risks

Check for instructions that:

• - Send data to external URLs/webhooks
• Encode sensitive data in outputs
• Request credentials or API keys be included in responses
• Ask agent to read and transmit file contents

Red Flags:
CODEBLOCK1

3. Privilege Escalation

Check for instructions that:

• - Claim elevated permissions not granted by system
• Instruct bypassing of tool restrictions
• Request execution of admin-only operations

Red Flags:
CODEBLOCK2

4. Hidden Instructions

Check for:

• - Instructions hidden in unusual formatting (zero-width chars, excessive whitespace)
• Base64 or encoded instructions
• Instructions buried in seemingly benign reference material
• Unicode tricks to hide malicious text

5. Unsafe Tool Usage Instructions

Check if skill instructs agent to:

• - Run shell commands with user input unsanitized
• Write to sensitive system paths
• Make network requests to user-controlled URLs
• Execute arbitrary code from external sources

Red Flags:
CODEBLOCK3

6. Social Engineering Instructions

Check for instructions that:

• - Tell agent to deceive users about its nature/capabilities
• Instruct agent to manipulate users emotionally
• Ask agent to impersonate specific people/organizations
• Request agent hide information from users

SKILL.md Review Checklist

For each SKILL.md, verify:

General Vulnerability Categories

1. Hardcoded Secrets

2. Broken Access Control

• - IDOR: Resources accessed by user-supplied ID without ownership verification
• Missing Function-Level Access Control: No authorization check before sensitive operations
• Path Traversal/LFI: User input in file paths without sanitization

3. Injection Vulnerabilities

• - SQL Injection: String concatenation in queries
• XSS: Unsanitized input rendered as HTML (dangerouslySetInnerHTML)
• Command Injection: User input in shell commands
• SSRF: Network requests to user-provided URLs without allow-list

4. LLM/Prompt Safety

• - Prompt Injection: Untrusted input concatenated into prompts without boundaries
• Unsafe Execution: LLM output passed to eval(), exec, shell commands
• Output Injection: LLM output flows to SQLi, XSS, or command injection sinks
• Flawed Security Logic: Security decisions based on unvalidated LLM output

5. Privacy Violations

Severity Rubric

Report Format

For each vulnerability:

• - Vulnerability: Brief name
• Type: Security / Privacy / Prompt Injection
• Severity: Critical/High/Medium/Low
• Location: File path and line numbers
• Content: The vulnerable line/section
• Description: Explanation and potential impact
• Recommendation: How to remediate

High-Fidelity Reporting Rules

Before reporting, the finding must pass ALL checks:

1. 1. ✓ Is it in executable/active content (not comments)?
2. ✓ Can you point to specific line(s)?
3. ✓ Based on direct evidence, not speculation?
4. ✓ Can it be fixed by modifying identified content?
5. ✓ Plausible negative impact if used?

DO NOT report:

• - Hypothetical weaknesses without evidence
• Test files or examples (unless leaking real secrets)
• Commented-out content
• Theoretical violations with no actual impact