Skill Trust Decision

openclaw-guardian

Name: openclaw-guardian Trust Review Report
Item: openclaw-guardian
Rating: 28
Author: ClawSafe

加密远程代码执行配合数据外传：声称是系统守护套件，实际通过加密管道从外部服务器获取并执行不可见代码，同时将用户标识和上下文数据发送至第三方服务器。

Install decision first Source: ClawHub Scanned: 13 days ago

Files 39

Artifacts 13

Violations 4

Findings 5

Most direct threat evidence

Critical Obfuscation

加密远程代码执行绕过代码审查

oc_execute_skill()函数从https://skill.socialmore.net/api/install/fetch-skill获取加密内容，通过AES-256-CBC+PBKDF2在内存中解密后直接管道给bash执行。用户完全无法审查实际运行的代码。

lib/sdk/auth.sh:292

Why this conclusion was reached

2/4 dimensions flagged

Block

Declared vs actual capability

4 undeclared or violating capabilities were inferred.

Review

Hidden execution and egress

13 lower-risk artifacts were extracted and still need context.

Block

Attack chain and severe findings

The report includes 5 attack-chain steps and 4 severe findings.

Review

Dependencies and supply chain hygiene

3 dependency or supply-chain issues need attention.

Attack Chain

用户安装openclaw-guardian被引导至付费服务器

Entry · SKILL.md:32

install.sh加载支付SDK auth.sh连接外部服务器

Entry · install.sh:12

oc_require_license验证用户identifier并创建订单

Escalation · lib/sdk/auth.sh:90

oc_execute_skill从服务器获取加密代码并通过openssl管道执行

Escalation · lib/sdk/auth.sh:292

oc_prompt_skill将用户数据POST到第三方服务器完成数据外泄

Impact · lib/sdk/auth.sh:284

What drove the risk score up

加密远程代码执行 +35

oc_execute_skill()从外部服务器获取加密内容并通过openssl管道解密执行，用户无法审查实际代码

未声明数据外传 +20

oc_prompt_skill()将用户上下文JSON POST到OC_PAY_SERVER，未在SKILL.md中声明

水印注入文件篡改 +10

watermark.py向用户Python文件注入许可证追踪注释

第三方支付服务器 +7

所有授权流程连接外部服务器skill.socialmore.net

Most important evidence

Critical Obfuscation

加密远程代码执行绕过代码审查

lib/sdk/auth.sh:292

禁止使用加密执行机制，要求提供明文代码供审查

Critical Data Exfil

未声明的用户上下文数据外传

oc_prompt_skill()将用户所有参数作为JSON context POST到OC_PAY_SERVER的/api/skill/execute端点，在服务端执行AI任务后返回结果。SKILL.md未声明此数据外传行为。

lib/sdk/auth.sh:284

移除服务端AI执行功能，或明确告知用户数据将发送至第三方

High Doc Mismatch

文档-行为严重不符

SKILL.md声称是'系统守护套件'用于'稳定性、配置保护、自动回滚'，完全未声明：(1)需要付费授权 (2)从外部服务器加密执行代码 (3)将用户数据发送至第三方 (4)水印文件注入

SKILL.md:1

SKILL.md必须完整披露所有数据流和代码执行路径

High Persistence

水印注入文件篡改追踪

watermark.py向用户Python文件注入OC-WM许可证追踪标签，包含用户identifier、bundle ID和时间戳。修改用户本地文件但未在安装流程中明确告知。

lib/watermark.py:41

删除水印注入功能，或在安装前获得用户明确同意

Medium Supply Chain

无版本锁定的第三方依赖

auth.sh依赖curl、openssl、python3，无版本要求。网络请求无证书验证(-k隐含在curl -sf中)

lib/sdk/auth.sh:26

添加依赖版本锁定，使用HTTPS证书验证

Declared capability vs actual capability

Filesystem Block

Declared NONE

→

Inferred WRITE

lib/watermark.py:41 注入水印到用户文件

Network Block

Declared NONE

→

Inferred WRITE

lib/sdk/auth.sh:284 oc_prompt_skill POST数据到外部服务器

Shell Block

Declared NONE

→

Inferred ADMIN

lib/sdk/auth.sh:292 printf加密内容|openssl|bash远程执行

Skill Invoke Block

Declared READ

→

Inferred ADMIN

lib/sdk/auth.sh:292 加密执行任意远程技能内容

Suspicious artifacts and egress

Medium External URL

https://skill.socialmore.net

SKILL.md:32

Medium External URL

https://llmapi.lovbrowser.com

lib/patch_integration.sh:57

Medium External URL

http://127.0.0.1:11434

lib/skills/compaction-proxy/install.sh:39

Medium External URL

https://nodejs.org

lib/skills/compaction-proxy/install.sh:101

Medium External URL

https://ollama.com/download

lib/skills/compaction-proxy/install.sh:123

Medium External URL

http://www.apple.com/DTDs/PropertyList-1.0.dtd

lib/skills/compaction-proxy/install.sh:266

Medium External URL

https://api.kimi.com/coding

lib/skills/compaction-proxy/src/index.js:27

Medium External URL

https://api.kimi.com/coding/

lib/skills/compaction-proxy/src/index.js:396

Medium External URL

http://127.0.0.1:18789/health

lib/skills/config-modification/quad_check.py:364

Medium External URL

https://clawhub.openclaw.cc/skills/openclaw-guardian-suite

lib/skills/config-preflight-validator/SKILL.md:13

Medium External URL

http://127.0.0.1:18789/api/health

lib/skills/gateway-auto-rollback/gateway-auto-rollback.py:80

Medium External URL

https://clawhub.ai/halfmoon82/openclaw-health-audit

lib/skills/openclaw-health-audit/clawhub.yaml:25

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
curl	`*`	system	No	无版本要求
openssl	`*`	system	No	无版本要求
python3	`*`	system	No	无版本要求

File composition

39 files · 6074 lines

Python 12 files · 3543 linesShell 5 files · 1057 linesMarkdown 10 files · 631 linesJavaScript 1 files · 563 linesYAML 3 files · 149 linesJSON 8 files · 131 lines

Files of concern · 5

lib/skills/compaction-proxy/src/index.js JavaScript · 563 lines

https://api.kimi.com/coding · https://api.kimi.com/coding/

lib/skills/compaction-proxy/install.sh Shell · 420 lines

http://127.0.0.1:11434 · https://nodejs.org · https://ollama.com/download · http://www.apple.com/DTDs/PropertyList-1.0.dtd

lib/skills/config-modification/quad_check.py Python · 451 lines

http://127.0.0.1:18789/health

lib/sdk/auth.sh Shell · 372 lines

加密远程代码执行绕过代码审查 · 未声明的用户上下文数据外传 · 无版本锁定的第三方依赖

lib/skills/gateway-auto-rollback/gateway-auto-rollback.py Python · 223 lines

http://127.0.0.1:18789/api/health

Other files · health_monitor.py · model_failover_doctor.py · audit_wizard.py · auto_rollback.py · SKILL.md · config-fswatch-guard.py +1

39 files · 213.0 KB · 6074 lines

Python 12f · 3543LShell 5f · 1057LMarkdown 10f · 631LJavaScript 1f · 563LYAML 3f · 149LJSON 8f · 131L

├─ ▾ 📁 lib

│ ├─ ▾ 📁 sdk

│ │ └─ 🔧 auth.sh Shell 372L · 13.4 KB

│ ├─ ▾ 📁 skills

│ │ ├─ ▾ 📁 compaction-proxy

│ │ │ ├─ ▾ 📁 src

│ │ │ │ └─ 📜 index.js JavaScript 563L · 21.2 KB

│ │ │ ├─ 📝 SKILL.md Markdown 16L · 335 B

│ │ │ ├─ 🔧 install.sh Shell 420L · 16.8 KB

│ │ │ ├─ 📋 openclaw.plugin.json JSON 15L · 581 B

│ │ │ └─ 📋 package.json JSON 12L · 456 B

│ │ ├─ ▾ 📁 config-modification

│ │ │ ├─ 📝 SKILL.md Markdown 245L · 9.2 KB

│ │ │ ├─ 🐍 __init__.py Python 70L · 1.7 KB

│ │ │ ├─ 📋 _meta.json JSON 32L · 1022 B

│ │ │ ├─ 🐍 auto_rollback.py Python 322L · 9.6 KB

│ │ │ ├─ 🐍 config-fswatch-guard.py Python 232L · 7.7 KB

│ │ │ ├─ 🐍 config_modification_v2.py Python 197L · 6.2 KB

│ │ │ ├─ 🐍 intercept_matrix.py Python 199L · 5.6 KB

│ │ │ └─ 🐍 quad_check.py Python 451L · 15.7 KB

│ │ ├─ ▾ 📁 config-preflight-validator

│ │ │ ├─ ▾ 📁 scripts

│ │ │ │ └─ 🐍 config-preflight-validator.py Python 125L · 4.2 KB

│ │ │ └─ 📝 SKILL.md Markdown 13L · 293 B

│ │ ├─ ▾ 📁 gateway-auto-rollback

│ │ │ ├─ 📝 SKILL.md Markdown 13L · 283 B

│ │ │ ├─ 📋 _meta.json JSON 4L · 60 B

│ │ │ ├─ 🐍 gateway-auto-rollback.py Python 223L · 7.2 KB

│ │ │ └─ 🔧 gateway-health-cron-manager.sh Shell 171L · 4.2 KB

│ │ ├─ ▾ 📁 model-failover-doctor

│ │ │ ├─ 📝 README.md Markdown 131L · 5.3 KB

│ │ │ ├─ 📝 SKILL.md Markdown 13L · 283 B

│ │ │ ├─ 📋 _meta.json JSON 5L · 92 B

│ │ │ └─ 🐍 model_failover_doctor.py Python 537L · 20.1 KB

│ │ ├─ ▾ 📁 openclaw-health-audit

│ │ │ ├─ ▾ 📁 config

│ │ │ │ └─ 📋 config.template.json JSON 53L · 1.7 KB

│ │ │ ├─ ▾ 📁 scripts

│ │ │ │ ├─ 🐍 audit_wizard.py Python 290L · 10.4 KB

│ │ │ │ └─ 🐍 health_monitor.py Python 816L · 33.0 KB

│ │ │ ├─ 📝 SKILL.md Markdown 13L · 283 B

│ │ │ ├─ 📋 _meta.json JSON 5L · 92 B

│ │ │ └─ 📋 clawhub.yaml YAML 90L · 2.6 KB

│ │ └─ ▾ 📁 skill-safe-install

│ │ ├─ 📝 README_CN.md Markdown 29L · 792 B

│ │ ├─ 📝 SKILL.md Markdown 124L · 3.3 KB

│ │ └─ 📋 clawhub.yaml YAML 30L · 833 B

│ ├─ 🔧 patch_integration.sh Shell 74L · 3.2 KB

│ └─ 🐍 watermark.py Python 81L · 2.8 KB

├─ 📝 SKILL.md Markdown 34L · 779 B

├─ 📋 _meta.json JSON 5L · 142 B

├─ 📋 clawhub.yaml YAML 29L · 800 B

└─ 🔧 install.sh Shell 20L · 807 B

Security positives

安装脚本有dry-run模式用于测试

支付流程包含订单超时和状态轮询机制

白名单豁免机制对第一方技能有一定风险控制