| Titre | OpenClaw ClawScan up to 0.1.6 (fixed in 0.1.7, commit 9f6a6fbb9f1137345566d0ab44c73893dfe112fa) Protection Mechanism Failure |
|---|
| Description | OpenClaw ClawScan through 0.1.6, scanner clawscan-static, never opens anything inside a directory named __pycache__. shouldSkipTargetPath in internal/runner/runner.go (v0.1.6, line 1040) returns true when any path component is one of .git, node_modules, vendor, .venv, or __pycache__. On a directory match the walker records that directory as omitted with reason "skipped path" and returns filepath.SkipDir. The four text rules (prompt_injection, credential_exfiltration, pipe_to_shell, destructive_shell) never see the files underneath.
This is not either ClawScan issue already accepted from VulDB submissions 933532 and 933533.
It is not the null-byte skip (openclaw/clawscan issue 42, CVE-2026-91835). That bug is IsBinaryFile in internal/runner/static_scanner.go: a file already chosen for scanning is dropped if it contains one NUL byte. Fixed separately in pull request 43. Here the __pycache__ directory is never entered, so that check never runs. A normal text .py or .sh file placed inside __pycache__ is omitted by this bug and is not omitted by the null-byte bug.
It is not the .git file-type skip (openclaw/clawscan issue 40, CVE-2026-91836). That bug skips a regular file named .git because the comparison looks only at the name. __pycache__ is a directory, and skipping that directory is the failure. CPython loads the .pyc files inside it at import time. Under PEP 552 UNCHECKED_HASH mode the bytecode is executed without being checked against the .py source beside it. A skill can ship clean decoy sources plus a malicious scripts/.../__pycache__/*.pyc. clawscan-static then reports zero findings and lists only the cache directory as a skipped path.
The vendor was told on 2026-08-10 in GitHub issue 39. Pull request 41, merged 2026-08-13, fixes the two path bugs as separate edits. .git, node_modules, vendor, and .venv are skipped only when they are directories. __pycache__ is removed from the skip list, and packaged bytecode is reported as a high-severity static.python_bytecode finding. That removal is what fixes this issue. v0.1.7 no longer contains __pycache__ in shouldSkipTargetDirectory. v0.1.6 and earlier are affected.
The judge workspace copy is not part of this report. The maintainer noted that the workspace copy already includes __pycache__ and excludes only .git and clawscan-results. The defect is the static scanner skip, which also withholds those files from the evidence handed to the judge.
Attack is local. An operator scans an attacker-supplied skill and then installs it. No authentication is required. Tested on clawscan-static v0.1.6. The public fixture builds the bytecode with py_compile and scans the skill directory. The skill runs os.system("whoami>pwn") at import time. The scan reports a clean result.
Impact is a protection mechanism failure with downstream code execution. The scanner gives a positive safety result for a skill that executes arbitrary code as the operator.
CVSS 3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 (High).
No CVE is assigned to issue 39. Issues 40 and 42 already have CVE-2026-91836 and CVE-2026-91835. This issue has not been sent to another CNA.
PoC: https://github.com/nedlir/skills-scanner-bypass
|
|---|
| La source | ⚠️ https://github.com/openclaw/clawscan/issues/39 |
|---|
| Utilisateur | nedlir (UID 95981) |
|---|
| Soumission | 28/09/2026 12:32 (il y a 17 jours) |
|---|
| Modérer | 14/10/2026 15:37 (16 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 419836 [OpenClaw ClawScan jusqu’à 0.1.6 Static Scanner runner.go shouldSkipTargetPath élévation de privilèges] |
|---|
| Points | 20 |
|---|