Skill Trust Decision

openclaw-guardian (OpenClaw 全能守护包)

Name: openclaw-guardian (OpenClaw 全能守护包) Trust Review Report
Item: openclaw-guardian (OpenClaw 全能守护包)
Rating: 30
Author: ClawSafe

OpenClaw Guardian Suite 包含多处文档-行为差异：主SKILL.md未披露加密执行机制、API密钥中继、服务器端AI执行能力，以及对系统配置和代码的深度修改权限。

Install decision first Source: ClawHub Scanned: 3 hr ago

Files 39

Artifacts 14

Violations 5

Findings 7

Most direct threat evidence

Critical Doc Mismatch

服务器端AI执行能力未披露

oc_prompt_skill() 函数允许服务端执行AI提示，用户提供的上下文（文件内容等）被发送到远程服务器处理。SKILL.md完全未提及此能力，用户无法知晓其数据被第三方服务器处理。

lib/sdk/auth.sh:228

Why this conclusion was reached

2/4 dimensions flagged

Block

Declared vs actual capability

5 undeclared or violating capabilities were inferred.

Review

Hidden execution and egress

14 lower-risk artifacts were extracted and still need context.

Block

Attack chain and severe findings

The report includes 4 attack-chain steps and 5 severe findings.

Pass

Dependencies and supply chain hygiene

Dependencies are present but no obvious high-risk issue stands out.

Attack Chain

用户通过 SKILL.md 描述触发安装，误以为仅是系统保护工具

Entry · SKILL.md:1

auth.sh 执行付费验证并获取加密内容

Escalation · lib/sdk/auth.sh:95

解密后的内容通过 bash -s 直接执行，无代码签名验证

Escalation · lib/sdk/auth.sh:263

oc_prompt_skill 将用户上下文发送到外部服务器处理

Impact · lib/sdk/auth.sh:228

What drove the risk score up

服务器端AI执行未披露 +20

oc_prompt_skill() 允许服务端执行AI提示，用户上下文被发送到远程服务器，SKILL.md完全未提及

API密钥中继架构未披露 +15

compaction-proxy将用户API密钥转发到外部LLM提供商，routes.json存储密钥，但文档仅描述为'本地压缩代理'

系统代码修改权限未声明 +15

model-failover-doctor/health_monitor可修改message-injector/index.ts、pools.json、cron/jobs.json等核心文件

加密执行模型部分隐藏 +10

虽然主SKILL.md提及付费，但未说明内容从外部服务器加密获取并在内存中解密执行

Gateway重启权限 +5

多个技能可执行 openclaw gateway restart 命令，SKILL.md未声明

外部服务器通信 +5

lib/sdk/auth.sh 多次与 skill.socialmore.net 通信，包括设备标识符、操作系统信息、版本号

Most important evidence

Critical Doc Mismatch

服务器端AI执行能力未披露

lib/sdk/auth.sh:228

必须在SKILL.md明确声明此功能，告知用户哪些数据会被发送到外部服务器

Critical Doc Mismatch

API密钥中继架构隐藏

compaction-proxy 将用户API密钥存储在 routes.json 并转发到外部LLM提供商。SKILL.md仅描述为'本地压缩代理'，未披露密钥中继架构。

lib/skills/compaction-proxy/src/index.js:27

SKILL.md需明确声明：1) API密钥将被存储并中继到上游提供商 2) 列出所有可能的上游服务商

High Doc Mismatch

系统代码修改权限未声明

model-failover-doctor 可直接修改 message-injector/index.ts 等核心代码文件，health_monitor 可修改 cron/jobs.json 和 session_model_state.json。SKILL.md未声明这些高危权限。

lib/skills/model-failover-doctor/model_failover_doctor.py:62

SKILL.md需列出所有可修改的系统文件路径和修改条件

High Priv Escalation

Gateway重启权限无声明

多个技能可执行 'openclaw gateway restart' 命令，可重启整个Gateway服务。SKILL.md未声明此高权限操作。

lib/skills/model-failover-doctor/model_failover_doctor.py:280

在SKILL.md声明此权限并说明触发条件

High Supply Chain

加密执行内容无法预审计

技能核心内容在支付后才从服务器获取并内存解密执行，用户无法在安装前审计代码内容，存在供应链风险。

lib/sdk/auth.sh:263

考虑提供加密前代码的部分审计版本，或使用更透明的授权机制

Medium Data Exfil

设备标识信息外传

auth.sh 在创建订单时发送 hostname、username、OS版本、OpenClaw版本到外部服务器。

lib/sdk/auth.sh:135

在SKILL.md明确声明此信息收集行为

Medium Sensitive Access

配置文件批量访问

health_monitor.py 访问 ~/.openclaw/ 下多个配置文件，包括 pools.json、session_model_state.json、openclaw.json 等。

lib/skills/openclaw-health-audit/scripts/health_monitor.py:56

SKILL.md需声明所有被访问的配置文件及其访问目的

Declared capability vs actual capability

Filesystem Block

Declared NONE

→

Inferred WRITE

lib/skills/model-failover-doctor/model_failover_doctor.py:62-68

Network Block

Declared NONE

→

Inferred READ+WRITE

lib/skills/compaction-proxy/src/index.js:27

Shell Block

Declared NONE

→

Inferred WRITE

lib/skills/model-failover-doctor/model_failover_doctor.py:280

Skill Invoke Block

Declared NONE

→

Inferred ADMIN

lib/sdk/auth.sh:228-261

Environment Block

Declared NONE

→

Inferred READ

lib/skills/openclaw-health-audit/scripts/health_monitor.py:78-93

Suspicious artifacts and egress

Medium External URL

https://skill.socialmore.net

SKILL.md:32

Medium External URL

https://clawhub.ai/halfmoon82/openclaw-guardian-suite

_meta.json:23

Medium External URL

https://llmapi.lovbrowser.com

lib/patch_integration.sh:57

Medium External URL

http://127.0.0.1:11434

lib/skills/compaction-proxy/install.sh:39

Medium External URL

https://nodejs.org

lib/skills/compaction-proxy/install.sh:101

Medium External URL

https://ollama.com/download

lib/skills/compaction-proxy/install.sh:123

Medium External URL

http://www.apple.com/DTDs/PropertyList-1.0.dtd

lib/skills/compaction-proxy/install.sh:266

Medium External URL

https://api.kimi.com/coding

lib/skills/compaction-proxy/src/index.js:27

Medium External URL

https://api.kimi.com/coding/

lib/skills/compaction-proxy/src/index.js:396

Medium External URL

http://127.0.0.1:18789/health

lib/skills/config-modification/quad_check.py:364

Medium External URL

https://clawhub.openclaw.cc/skills/openclaw-guardian-suite

lib/skills/config-preflight-validator/SKILL.md:13

Medium External URL

http://127.0.0.1:18789/api/health

lib/skills/gateway-auto-rollback/gateway-auto-rollback.py:80

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
requests (via curl)	`system`	system	No	使用系统curl命令
python3 standard library	`builtin`	stdlib	No	主要依赖Python标准库

File composition

39 files · 6104 lines

Python 12 files · 3543 linesShell 5 files · 1057 linesMarkdown 10 files · 631 linesJavaScript 1 files · 563 linesJSON 8 files · 161 linesYAML 3 files · 149 lines

Files of concern · 7

lib/skills/openclaw-health-audit/scripts/health_monitor.py Python · 816 lines

配置文件批量访问

lib/skills/compaction-proxy/src/index.js JavaScript · 563 lines

API密钥中继架构隐藏 · https://api.kimi.com/coding · https://api.kimi.com/coding/

lib/skills/model-failover-doctor/model_failover_doctor.py Python · 537 lines

系统代码修改权限未声明 · Gateway重启权限无声明

lib/skills/compaction-proxy/install.sh Shell · 420 lines

http://127.0.0.1:11434 · https://nodejs.org · https://ollama.com/download · http://www.apple.com/DTDs/PropertyList-1.0.dtd

lib/skills/config-modification/quad_check.py Python · 451 lines

http://127.0.0.1:18789/health

lib/sdk/auth.sh Shell · 372 lines

服务器端AI执行能力未披露 · 加密执行内容无法预审计 · 设备标识信息外传

lib/skills/gateway-auto-rollback/gateway-auto-rollback.py Python · 223 lines

http://127.0.0.1:18789/api/health

Other files · audit_wizard.py · auto_rollback.py · SKILL.md · config-fswatch-guard.py · config_modification_v2.py

39 files · 214.2 KB · 6104 lines

Python 12f · 3543LShell 5f · 1057LMarkdown 10f · 631LJavaScript 1f · 563LJSON 8f · 161LYAML 3f · 149L

├─ ▾ 📁 lib

│ ├─ ▾ 📁 sdk

│ │ └─ 🔧 auth.sh Shell 372L · 13.4 KB

│ ├─ ▾ 📁 skills

│ │ ├─ ▾ 📁 compaction-proxy

│ │ │ ├─ ▾ 📁 src

│ │ │ │ └─ 📜 index.js JavaScript 563L · 21.2 KB

│ │ │ ├─ 📝 SKILL.md Markdown 16L · 335 B

│ │ │ ├─ 🔧 install.sh Shell 420L · 16.8 KB

│ │ │ ├─ 📋 openclaw.plugin.json JSON 15L · 581 B

│ │ │ └─ 📋 package.json JSON 12L · 456 B

│ │ ├─ ▾ 📁 config-modification

│ │ │ ├─ 📝 SKILL.md Markdown 245L · 9.2 KB

│ │ │ ├─ 🐍 __init__.py Python 70L · 1.7 KB

│ │ │ ├─ 📋 _meta.json JSON 32L · 1022 B

│ │ │ ├─ 🐍 auto_rollback.py Python 322L · 9.6 KB

│ │ │ ├─ 🐍 config-fswatch-guard.py Python 232L · 7.7 KB

│ │ │ ├─ 🐍 config_modification_v2.py Python 197L · 6.2 KB

│ │ │ ├─ 🐍 intercept_matrix.py Python 199L · 5.6 KB

│ │ │ └─ 🐍 quad_check.py Python 451L · 15.7 KB

│ │ ├─ ▾ 📁 config-preflight-validator

│ │ │ ├─ ▾ 📁 scripts

│ │ │ │ └─ 🐍 config-preflight-validator.py Python 125L · 4.2 KB

│ │ │ └─ 📝 SKILL.md Markdown 13L · 293 B

│ │ ├─ ▾ 📁 gateway-auto-rollback

│ │ │ ├─ 📝 SKILL.md Markdown 13L · 283 B

│ │ │ ├─ 📋 _meta.json JSON 4L · 60 B

│ │ │ ├─ 🐍 gateway-auto-rollback.py Python 223L · 7.2 KB

│ │ │ └─ 🔧 gateway-health-cron-manager.sh Shell 171L · 4.2 KB

│ │ ├─ ▾ 📁 model-failover-doctor

│ │ │ ├─ 📝 README.md Markdown 131L · 5.3 KB

│ │ │ ├─ 📝 SKILL.md Markdown 13L · 283 B

│ │ │ ├─ 📋 _meta.json JSON 5L · 92 B

│ │ │ └─ 🐍 model_failover_doctor.py Python 537L · 20.1 KB

│ │ ├─ ▾ 📁 openclaw-health-audit

│ │ │ ├─ ▾ 📁 config

│ │ │ │ └─ 📋 config.template.json JSON 53L · 1.7 KB

│ │ │ ├─ ▾ 📁 scripts

│ │ │ │ ├─ 🐍 audit_wizard.py Python 290L · 10.4 KB

│ │ │ │ └─ 🐍 health_monitor.py Python 816L · 33.0 KB

│ │ │ ├─ 📝 SKILL.md Markdown 13L · 283 B

│ │ │ ├─ 📋 _meta.json JSON 5L · 92 B

│ │ │ └─ 📋 clawhub.yaml YAML 90L · 2.6 KB

│ │ └─ ▾ 📁 skill-safe-install

│ │ ├─ 📝 README_CN.md Markdown 29L · 792 B

│ │ ├─ 📝 SKILL.md Markdown 124L · 3.3 KB

│ │ └─ 📋 clawhub.yaml YAML 30L · 833 B

│ ├─ 🔧 patch_integration.sh Shell 74L · 3.2 KB

│ └─ 🐍 watermark.py Python 81L · 2.8 KB

├─ 📝 SKILL.md Markdown 34L · 779 B

├─ 📋 _meta.json JSON 35L · 1.3 KB

├─ 📋 clawhub.yaml YAML 29L · 800 B

└─ 🔧 install.sh Shell 20L · 807 B

Security positives

compaction-proxy 的 routes.json 设置了 600 权限保护API密钥

config-modification 提供了备份机制（backup目录）

多个技能有 dry-run 模式支持预览

config-modification 包含四联校验机制提升安全性