安全决策报告

openclaw-guardian-suite

Name: openclaw-guardian-suite 可信度判断报告
Item: openclaw-guardian-suite
Rating: 75
Author: ClawSafe

A legitimate commercial skill suite with disclosed encrypted remote-code-execution architecture. No malicious behavior found—credential harvesting, data exfiltration, obfuscation, or hidden sensitive-path access are all absent. The encrypted `oc_execute_skill()` pipeline is the primary risk vector (server could theoretically inject payload) but is explicitly documented in SKILL.md and install.sh, representing a known commercial pattern rather than covert malware.

安装决策优先来源: ClawHub 扫描时间: 2026/9/21

文件 39

IOC 13

越权项 0

发现 4

为什么得出这个结论

0/4 个维度触发

通过

声明与实际能力

声明资源与推断能力基本一致。

复核

隐藏执行与外联

提取到 13 个一般风险产物，需要结合上下文判断。

通过

攻击链与高危发现

没有形成明确的恶意路径。

通过

依赖与供应链卫生

依赖结构存在，但暂未看到明显高危告警。

风险分是怎么被拉高的

Encrypted remote code execution pipeline +15

oc_execute_skill() fetches encrypted skill content from skill.socialmore.net and pipes decrypted output directly to bash. If the server is compromised, arbitrary code could be injected. This pattern is explicitly disclosed in SKILL.md and install.sh, making it a commercial risk rather than covert malware.

subprocess calls for configuration management +5

Python scripts call subprocess.run() for curl, openclaw CLI, and backup scripts. These are necessary for config validation, health checks, and rollback operations—fully documented in SKILL.md and proportionate to the skill's purpose.

Filesystem WRITE for config management +3

config-modification and gateway-auto-rollback write to ~/.openclaw/ JSON configs and backup files. These operations are the core functionality of the skill and are clearly declared in SKILL.md.

OC-WM watermark injection +2

watermark.py injects '# [OC-WM] licensed-to: identifier | bundle: vendor-suite' comments into installed .py files. This is a license-tracking mechanism, not malicious—clearly labeled and only modifies files within the skill's own directory.

最关键的证据

中危供应链

Encrypted remote code execution via external server

The oc_execute_skill() function in auth.sh fetches encrypted skill content from skill.socialmore.net, decrypts it in memory using openssl AES-256-CBC, and pipes the output directly to bash. This means the actual executed code is never visible locally and depends entirely on the server's integrity. While explicitly disclosed in SKILL.md and install.sh, this is a non-standard trust model for AI agent skills.

lib/sdk/auth.sh:150

Understand that skill code is downloaded from a third-party server. Consider running in a sandboxed environment. The server skill.socialmore.net could theoretically serve modified code after payment.

低危供应链

API keys stored in routes.json without encryption at rest

The compaction-proxy install.sh collects API keys for LLM providers and writes them to ~/.openclaw/compaction-proxy/routes.json with 600 permissions. While the installer does chmod 600, the keys are stored in plaintext on disk.

lib/skills/compaction-proxy/install.sh:245

Consider using the system's keychain (macOS Keychain or Linux secret-service) instead of plaintext JSON for storing API keys. For the current model, ensure filesystem permissions are strictly enforced.

低危文档欺骗

Individual skill SKILL.md files are minimal or placeholder content

Six of the seven skills (model-failover-doctor, config-preflight-validator, gateway-auto-rollback, openclaw-health-audit, compaction-proxy) have SKILL.md files containing only purchase/activation instructions with no detailed behavior documentation. The actual implementation details exist only in the Python/JS source files. The main SKILL.md at root also lacks detailed permission declarations.

lib/skills/model-failover-doctor/SKILL.md:1

Expand individual skill SKILL.md files with detailed capability declarations, permission mappings, and security-relevant behavior descriptions.

低危持久化

launchd plist registration for compaction-proxy

The compaction-proxy install.sh creates a macOS launchd plist at ~/Library/LaunchAgents/ai.openclaw.compaction-proxy.plist that runs on boot and auto-restarts on crash. This is standard persistence for a local proxy service, documented in the installer, but users should be aware the proxy will auto-start.

lib/skills/compaction-proxy/install.sh:252

Users should be aware of the auto-start behavior. The plist can be removed with: launchctl unload ~/Library/LaunchAgents/ai.openclaw.compaction-proxy.plist

声明能力 vs 实际能力

文件系统 通过

声明 WRITE

→

推断 WRITE

config_modification_v2.py:line 55, gateway-auto-rollback.py:line 45, model_failover_doctor.py:line 63

网络访问 通过

声明 READ

→

推断 READ

auth.sh:line 57, auth.sh:line 80, config-preflight-validator.py:line 27

命令执行 通过

声明 WRITE

→

推断 WRITE

config_modification_v2.py:line 60 (subprocess for backup), health_monitor.py:line 31 (openclaw CLI), model_failover_doctor.py:line 71 (subprocess for restart)

环境变量 通过

声明 READ

→

推断 READ

health_monitor.py:line 19 (PATH constants), compaction-proxy/index.js:line 28 (UPSTREAM env vars)

剪贴板 通过

声明 NONE

→

推断 NONE

No clipboard access found in any script

浏览器 通过

声明 NONE

→

推断 NONE

auth.sh opens payment URL in browser but only when user explicitly consents (read -p prompt), which is standard payment UX

数据库 通过

声明 NONE

→

推断 NONE

No database access found

可疑产物与外联

中危外部 URL

https://skill.socialmore.net

SKILL.md:32

中危外部 URL

https://llmapi.lovbrowser.com

lib/patch_integration.sh:57

中危外部 URL

http://127.0.0.1:11434

lib/skills/compaction-proxy/install.sh:39

中危外部 URL

https://nodejs.org

lib/skills/compaction-proxy/install.sh:101

中危外部 URL

https://ollama.com/download

lib/skills/compaction-proxy/install.sh:123

中危外部 URL

http://www.apple.com/DTDs/PropertyList-1.0.dtd

lib/skills/compaction-proxy/install.sh:266

中危外部 URL

https://api.kimi.com/coding

lib/skills/compaction-proxy/src/index.js:27

中危外部 URL

https://api.kimi.com/coding/

lib/skills/compaction-proxy/src/index.js:396

中危外部 URL

http://127.0.0.1:18789/health

lib/skills/config-modification/quad_check.py:364

中危外部 URL

https://clawhub.openclaw.cc/skills/openclaw-guardian-suite

lib/skills/config-preflight-validator/SKILL.md:13

中危外部 URL

http://127.0.0.1:18789/api/health

lib/skills/gateway-auto-rollback/gateway-auto-rollback.py:80

中危外部 URL

https://clawhub.ai/halfmoon82/openclaw-health-audit

lib/skills/openclaw-health-audit/clawhub.yaml:25

依赖与供应链

包名	版本	来源	漏洞	备注
python3	`3.9+`	system	否	Required for all Python scripts
curl	`any`	system	否	Used for health checks and license verification only
openssl	`any`	system	否	Used for encrypted skill decryption (aes-256-cbc, pbkdf2, 10000 iterations)
node	`22+`	system	否	Required for compaction-proxy only
ollama	`any`	external	否	Local summarization engine for compaction-proxy (localhost only, not a supply chain risk)

文件构成

39 个文件 · 6074 行

Python 12 个文件 · 3543 行Shell 5 个文件 · 1057 行Markdown 10 个文件 · 631 行JavaScript 1 个文件 · 563 行YAML 3 个文件 · 149 行JSON 8 个文件 · 131 行

需关注文件 · 5

lib/skills/compaction-proxy/src/index.js JavaScript · 563 行

https://api.kimi.com/coding · https://api.kimi.com/coding/

lib/skills/compaction-proxy/install.sh Shell · 420 行

API keys stored in routes.json without encryption at rest · launchd plist registration for compaction-proxy · http://127.0.0.1:11434 · https://nodejs.org · https://ollama.com/download · http://www.apple.com/DTDs/PropertyList-1.0.dtd

lib/skills/config-modification/quad_check.py Python · 451 行

http://127.0.0.1:18789/health

lib/sdk/auth.sh Shell · 372 行

Encrypted remote code execution via external server

lib/skills/gateway-auto-rollback/gateway-auto-rollback.py Python · 223 行

http://127.0.0.1:18789/api/health

其他文件 · health_monitor.py · model_failover_doctor.py · audit_wizard.py · auto_rollback.py · SKILL.md · config-fswatch-guard.py +1

39 文件 · 213.0 KB · 6074 行

Python 12f · 3543LShell 5f · 1057LMarkdown 10f · 631LJavaScript 1f · 563LYAML 3f · 149LJSON 8f · 131L

├─ ▾ 📁 lib

│ ├─ ▾ 📁 sdk

│ │ └─ 🔧 auth.sh Shell 372L · 13.4 KB

│ ├─ ▾ 📁 skills

│ │ ├─ ▾ 📁 compaction-proxy

│ │ │ ├─ ▾ 📁 src

│ │ │ │ └─ 📜 index.js JavaScript 563L · 21.2 KB

│ │ │ ├─ 📝 SKILL.md Markdown 16L · 335 B

│ │ │ ├─ 🔧 install.sh Shell 420L · 16.8 KB

│ │ │ ├─ 📋 openclaw.plugin.json JSON 15L · 581 B

│ │ │ └─ 📋 package.json JSON 12L · 456 B

│ │ ├─ ▾ 📁 config-modification

│ │ │ ├─ 📝 SKILL.md Markdown 245L · 9.2 KB

│ │ │ ├─ 🐍 __init__.py Python 70L · 1.7 KB

│ │ │ ├─ 📋 _meta.json JSON 32L · 1022 B

│ │ │ ├─ 🐍 auto_rollback.py Python 322L · 9.6 KB

│ │ │ ├─ 🐍 config-fswatch-guard.py Python 232L · 7.7 KB

│ │ │ ├─ 🐍 config_modification_v2.py Python 197L · 6.2 KB

│ │ │ ├─ 🐍 intercept_matrix.py Python 199L · 5.6 KB

│ │ │ └─ 🐍 quad_check.py Python 451L · 15.7 KB

│ │ ├─ ▾ 📁 config-preflight-validator

│ │ │ ├─ ▾ 📁 scripts

│ │ │ │ └─ 🐍 config-preflight-validator.py Python 125L · 4.2 KB

│ │ │ └─ 📝 SKILL.md Markdown 13L · 293 B

│ │ ├─ ▾ 📁 gateway-auto-rollback

│ │ │ ├─ 📝 SKILL.md Markdown 13L · 283 B

│ │ │ ├─ 📋 _meta.json JSON 4L · 60 B

│ │ │ ├─ 🐍 gateway-auto-rollback.py Python 223L · 7.2 KB

│ │ │ └─ 🔧 gateway-health-cron-manager.sh Shell 171L · 4.2 KB

│ │ ├─ ▾ 📁 model-failover-doctor

│ │ │ ├─ 📝 README.md Markdown 131L · 5.3 KB

│ │ │ ├─ 📝 SKILL.md Markdown 13L · 283 B

│ │ │ ├─ 📋 _meta.json JSON 5L · 92 B

│ │ │ └─ 🐍 model_failover_doctor.py Python 537L · 20.1 KB

│ │ ├─ ▾ 📁 openclaw-health-audit

│ │ │ ├─ ▾ 📁 config

│ │ │ │ └─ 📋 config.template.json JSON 53L · 1.7 KB

│ │ │ ├─ ▾ 📁 scripts

│ │ │ │ ├─ 🐍 audit_wizard.py Python 290L · 10.4 KB

│ │ │ │ └─ 🐍 health_monitor.py Python 816L · 33.0 KB

│ │ │ ├─ 📝 SKILL.md Markdown 13L · 283 B

│ │ │ ├─ 📋 _meta.json JSON 5L · 92 B

│ │ │ └─ 📋 clawhub.yaml YAML 90L · 2.6 KB

│ │ └─ ▾ 📁 skill-safe-install

│ │ ├─ 📝 README_CN.md Markdown 29L · 792 B

│ │ ├─ 📝 SKILL.md Markdown 124L · 3.3 KB

│ │ └─ 📋 clawhub.yaml YAML 30L · 833 B

│ ├─ 🔧 patch_integration.sh Shell 74L · 3.2 KB

│ └─ 🐍 watermark.py Python 81L · 2.8 KB

├─ 📝 SKILL.md Markdown 34L · 779 B

├─ 📋 _meta.json JSON 5L · 142 B

├─ 📋 clawhub.yaml YAML 29L · 800 B

└─ 🔧 install.sh Shell 20L · 807 B

安全亮点

No credential harvesting: Scripts read environment variables for config but do not enumerate os.environ or scan for sensitive keys like AWS, SSH, or .env files

No data exfiltration: All network calls are to documented endpoints (skill.socialmore.net for licensing, 127.0.0.1:11434 for local Ollama, 127.0.0.1:18789 for gateway health)

No obfuscation: No base64-encoded strings, no eval(atob()), no HTML comment injection, no anti-analysis tricks

No sensitive path access: Scripts do not access ~/.ssh, ~/.aws, /etc/passwd, or other sensitive system paths

Comprehensive backup system: All config-modification scripts create backups before changes, with SHA256 hash verification

Explicit documentation: SKILL.md and install.sh explicitly disclose the encrypted remote-code-execution pattern

Intentional copyright notices: 'Powered by halfmoon82' and OC-WM watermarks are clearly labeled, indicating legitimate commercial development

No curl|bash remote execution: No scripts download and execute code from arbitrary URLs at runtime

Subprocess usage is proportionate: All subprocess calls are for documented operations (curl for health checks, openclaw CLI for gateway operations, backup scripts for rollback)

Version pinning references: Skills reference specific patch versions (M1/M3, FIX-0/1/2/3/4) indicating organized development rather than ad-hoc code