Security audit reveals vulnerabilities in OpenClaw skill ecosystem
OpenClaw security vulnerabilities discovered
A detailed security audit of OpenClaw's codebase and skill library revealed multiple security concerns that developers should be aware of when running the system in production environments.
Documented CVEs and exploitation
The audit identified 8 documented Common Vulnerabilities and Exposures (CVEs), including:
- Arbitrary code execution through unvetted skills
- Credential theft via skill injection
- Prompt extraction from untrusted inputs
Some of these vulnerabilities were actively exploited according to the vulnerability disclosure repository.
Skill library security issues
The shared skills repository contains over 900 skills. Static analysis revealed:
- Approximately 15% exhibited suspicious network behavior (phoning home to unknown domains)
- Dependency confusion attacks in popular skills
- Skills that quietly exfiltrate environment variables
While this pattern isn't unique to OpenClaw—it's common in any plugin/skills system that executes unvetted code—the auditor noted it was surprising given the "secure self-hosted" positioning.
Alternative implementation approach
The auditor migrated to a minimal Rust-based runtime that runs locally on Ollama using qwen2.5:14b. This approach eliminates the plugin ecosystem and shared skills, focusing only on necessary primitives for their use case.
The new architecture uses a task runner that delegates to Claude Code for heavy lifting while keeping it isolated from the main loop. This isolation prevents the permanent companion agent from being exposed to attack surfaces outside the developer's control.
The migration took approximately 48 hours to implement basic functionality, with the main challenge being architectural rethinking for "permanent companion" versus "on-demand tool" paradigms.
Security recommendations
For developers running OpenClaw in production:
- Audit your skills thoroughly
- Lock down skill execution permissions
- Assume any untrusted skill can perform any action your agent can execute
- Prioritize threat modeling over feature richness
📖 Read the full source: r/LocalLLaMA
👀 See Also
Clawndom: A Security Hook for Claude Code to Block Vulnerable npm Packages
A developer built Clawndom, an open-source hook for Claude Code that checks npm packages against the OSV.dev vulnerability database before installation, blocking known vulnerable packages while maintaining agent autonomy.
Axios 1.14.1 compromised with malware, targets AI-assisted development workflows
Axios version 1.14.1 has been compromised in a supply chain attack that silently pulls in [email protected], an obfuscated RAT dropper. Developers using AI coding assistants like Claude should immediately check their lockfiles and machines for infection.
Essential File Blocking for AI Coding Assistants: A Practical Security Checklist
AI coding assistants read from your local disk, not just your repository, exposing files that .gitignore protects from GitHub but not from the agent. A Reddit discussion identifies critical files to block including AI assistant configs with API keys, service credentials, SSH keys, and environment files.
Cisco source code stolen via Trivy supply chain attack
Cisco's internal development environment was breached using stolen credentials from the Trivy supply chain attack, resulting in the theft of source code from over 300 GitHub repositories including AI-powered products and customer code.