Skill Trust Decision
openclaw-guardian-suite
A legitimate commercial skill suite with disclosed encrypted remote-code-execution architecture. No malicious behavior found—credential harvesting, data exfiltration, obfuscation, or hidden sensitive-path access are all absent. The encrypted `oc_execute_skill()` pipeline is the primary risk vector (server could theoretically inject payload) but is explicitly documented in SKILL.md and install.sh, representing a known commercial pattern rather than covert malware.
Why this conclusion was reached
0/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Review
Hidden execution and egress
13 lower-risk artifacts were extracted and still need context.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
What drove the risk score up
Encrypted remote code execution pipeline +15
oc_execute_skill() fetches encrypted skill content from skill.socialmore.net and pipes decrypted output directly to bash. If the server is compromised, arbitrary code could be injected. This pattern is explicitly disclosed in SKILL.md and install.sh, making it a commercial risk rather than covert malware.
subprocess calls for configuration management +5
Python scripts call subprocess.run() for curl, openclaw CLI, and backup scripts. These are necessary for config validation, health checks, and rollback operations—fully documented in SKILL.md and proportionate to the skill's purpose.
Filesystem WRITE for config management +3
config-modification and gateway-auto-rollback write to ~/.openclaw/ JSON configs and backup files. These operations are the core functionality of the skill and are clearly declared in SKILL.md.
OC-WM watermark injection +2
watermark.py injects '# [OC-WM] licensed-to: identifier | bundle: vendor-suite' comments into installed .py files. This is a license-tracking mechanism, not malicious—clearly labeled and only modifies files within the skill's own directory.
Most important evidence
Medium Supply Chain
Encrypted remote code execution via external server
The oc_execute_skill() function in auth.sh fetches encrypted skill content from skill.socialmore.net, decrypts it in memory using openssl AES-256-CBC, and pipes the output directly to bash. This means the actual executed code is never visible locally and depends entirely on the server's integrity. While explicitly disclosed in SKILL.md and install.sh, this is a non-standard trust model for AI agent skills.
lib/sdk/auth.sh:150 Understand that skill code is downloaded from a third-party server. Consider running in a sandboxed environment. The server skill.socialmore.net could theoretically serve modified code after payment.
Low Supply Chain
API keys stored in routes.json without encryption at rest
The compaction-proxy install.sh collects API keys for LLM providers and writes them to ~/.openclaw/compaction-proxy/routes.json with 600 permissions. While the installer does chmod 600, the keys are stored in plaintext on disk.
lib/skills/compaction-proxy/install.sh:245 Consider using the system's keychain (macOS Keychain or Linux secret-service) instead of plaintext JSON for storing API keys. For the current model, ensure filesystem permissions are strictly enforced.
Low Doc Mismatch
Individual skill SKILL.md files are minimal or placeholder content
Six of the seven skills (model-failover-doctor, config-preflight-validator, gateway-auto-rollback, openclaw-health-audit, compaction-proxy) have SKILL.md files containing only purchase/activation instructions with no detailed behavior documentation. The actual implementation details exist only in the Python/JS source files. The main SKILL.md at root also lacks detailed permission declarations.
lib/skills/model-failover-doctor/SKILL.md:1 Expand individual skill SKILL.md files with detailed capability declarations, permission mappings, and security-relevant behavior descriptions.
Low Persistence
launchd plist registration for compaction-proxy
The compaction-proxy install.sh creates a macOS launchd plist at ~/Library/LaunchAgents/ai.openclaw.compaction-proxy.plist that runs on boot and auto-restarts on crash. This is standard persistence for a local proxy service, documented in the installer, but users should be aware the proxy will auto-start.
lib/skills/compaction-proxy/install.sh:252 Users should be aware of the auto-start behavior. The plist can be removed with: launchctl unload ~/Library/LaunchAgents/ai.openclaw.compaction-proxy.plist
Declared capability vs actual capability
Filesystem Pass
Declared WRITE
→ Inferred WRITE
config_modification_v2.py:line 55, gateway-auto-rollback.py:line 45, model_failover_doctor.py:line 63 Network Pass
Declared READ
→ Inferred READ
auth.sh:line 57, auth.sh:line 80, config-preflight-validator.py:line 27 Shell Pass
Declared WRITE
→ Inferred WRITE
config_modification_v2.py:line 60 (subprocess for backup), health_monitor.py:line 31 (openclaw CLI), model_failover_doctor.py:line 71 (subprocess for restart) Environment Pass
Declared READ
→ Inferred READ
health_monitor.py:line 19 (PATH constants), compaction-proxy/index.js:line 28 (UPSTREAM env vars) Clipboard Pass
Declared NONE
→ Inferred NONE
No clipboard access found in any script Browser Pass
Declared NONE
→ Inferred NONE
auth.sh opens payment URL in browser but only when user explicitly consents (read -p prompt), which is standard payment UX Database Pass
Declared NONE
→ Inferred NONE
No database access found Suspicious artifacts and egress
Medium External URL
https://skill.socialmore.net SKILL.md:32
Medium External URL
https://llmapi.lovbrowser.com lib/patch_integration.sh:57
Medium External URL
http://127.0.0.1:11434 lib/skills/compaction-proxy/install.sh:39
Medium External URL
https://nodejs.org lib/skills/compaction-proxy/install.sh:101
Medium External URL
https://ollama.com/download lib/skills/compaction-proxy/install.sh:123
Medium External URL
http://www.apple.com/DTDs/PropertyList-1.0.dtd lib/skills/compaction-proxy/install.sh:266
Medium External URL
https://api.kimi.com/coding lib/skills/compaction-proxy/src/index.js:27
Medium External URL
https://api.kimi.com/coding/ lib/skills/compaction-proxy/src/index.js:396
Medium External URL
http://127.0.0.1:18789/health lib/skills/config-modification/quad_check.py:364
Medium External URL
https://clawhub.openclaw.cc/skills/openclaw-guardian-suite lib/skills/config-preflight-validator/SKILL.md:13
Medium External URL
http://127.0.0.1:18789/api/health lib/skills/gateway-auto-rollback/gateway-auto-rollback.py:80
Medium External URL
https://clawhub.ai/halfmoon82/openclaw-health-audit lib/skills/openclaw-health-audit/clawhub.yaml:25
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| python3 | 3.9+ | system | No | Required for all Python scripts |
| curl | any | system | No | Used for health checks and license verification only |
| openssl | any | system | No | Used for encrypted skill decryption (aes-256-cbc, pbkdf2, 10000 iterations) |
| node | 22+ | system | No | Required for compaction-proxy only |
| ollama | any | external | No | Local summarization engine for compaction-proxy (localhost only, not a supply chain risk) |
File composition
39 files · 6074 lines
Python 12 files · 3543 linesShell 5 files · 1057 linesMarkdown 10 files · 631 linesJavaScript 1 files · 563 linesYAML 3 files · 149 linesJSON 8 files · 131 lines
Files of concern · 5
lib/skills/compaction-proxy/src/index.js https://api.kimi.com/coding · https://api.kimi.com/coding/
lib/skills/compaction-proxy/install.sh API keys stored in routes.json without encryption at rest · launchd plist registration for compaction-proxy · http://127.0.0.1:11434 · https://nodejs.org · https://ollama.com/download · http://www.apple.com/DTDs/PropertyList-1.0.dtd
lib/skills/config-modification/quad_check.py http://127.0.0.1:18789/health
lib/sdk/auth.sh Encrypted remote code execution via external server
lib/skills/gateway-auto-rollback/gateway-auto-rollback.py http://127.0.0.1:18789/api/health
Other files · health_monitor.py · model_failover_doctor.py · audit_wizard.py · auto_rollback.py · SKILL.md · config-fswatch-guard.py +1
Security positives
No credential harvesting: Scripts read environment variables for config but do not enumerate os.environ or scan for sensitive keys like AWS, SSH, or .env files
No data exfiltration: All network calls are to documented endpoints (skill.socialmore.net for licensing, 127.0.0.1:11434 for local Ollama, 127.0.0.1:18789 for gateway health)
No obfuscation: No base64-encoded strings, no eval(atob()), no HTML comment injection, no anti-analysis tricks
No sensitive path access: Scripts do not access ~/.ssh, ~/.aws, /etc/passwd, or other sensitive system paths
Comprehensive backup system: All config-modification scripts create backups before changes, with SHA256 hash verification
Explicit documentation: SKILL.md and install.sh explicitly disclose the encrypted remote-code-execution pattern
Intentional copyright notices: 'Powered by halfmoon82' and OC-WM watermarks are clearly labeled, indicating legitimate commercial development
No curl|bash remote execution: No scripts download and execute code from arbitrary URLs at runtime
Subprocess usage is proportionate: All subprocess calls are for documented operations (curl for health checks, openclaw CLI for gateway operations, backup scripts for rollback)
Version pinning references: Skills reference specific patch versions (M1/M3, FIX-0/1/2/3/4) indicating organized development rather than ad-hoc code