| Titolo | OpenClaw ClawScan v0.1.6 Incomplete Comparison with Missing Factors |
|---|
| Descrizione | This is fixed on:
https://github.com/openclaw/clawscan/pull/41
And this is fixing:
https://github.com/openclaw/clawscan/pull/40
A vulnerability was found in OpenClaw ClawScan 0.1.6. Affected is the built-in clawscan-static scanner in internal/runner/static_scanner.go at line 219, and the shared target-file renderer in internal/runner/runner.go at line 1043.
ClawScan analyses untrusted third-party "skill" packages. Its directory walk applies a path-level skip helper by name before inspecting whether the entry is a directory or a regular file. A regular file named .git is therefore recorded as a skipped path and its contents are never read, so none of the product's four detection rules (static.prompt_injection, static.credential_exfiltration, static.pipe_to_shell, static.destructive_shell) are ever applied to it. A .git regular file is a standard Git construct produced by git submodule and git worktree, so its presence is not itself anomalous.
The same omission applies to the direct target-file renderer, so the file is also excluded from the text presented to any configured LLM judge. The bypass is therefore transitive: content the static scanner never reads cannot be surfaced by a downstream judge.
The defect is not limited to .git. Any regular file whose name matches an entry in the skip list, including .venv, __pycache__ and node_modules, is treated as a directory by the name-based comparison and omitted on the same path.
Proof of concept: a skill directory containing a clean SKILL.md manifest, a greet.py plugin loader that iterates the directory and calls runpy.run_path() on each file that is not .md or .json, and a regular file named .git containing "import os" followed by os.system("whoami > pwn"). Running "clawscan ./hello-skill --scanner clawscan-static" reports issues_found 0, with the JSON artifact listing SKILL.md and greet.py under files.scanned and .git under files.omitted with reason "skipped path". Running "python hello-skill/greet.py" creates a file named pwn containing the output of whoami.
The vendor's own automated review confirmed the defect against current main on 2026-08-11 at confidence 0.98, labelling the issue P1 and impact:security, and recording that the static scanner skips a regular .git file by name before inspecting its type, preventing rule matching and evidence generation for that content. That review also confirmed the same path-level skip is applied by the target-file renderer used for judge prompts.
The impact is that arbitrary content can be shipped inside a skill under a name that the scanner assumes denotes a directory, with a guarantee that it will not be read by the static scanner or presented to a downstream judge, while the product reports zero findings.
The weakness is classified as CWE-1023 (Incomplete Comparison with Missing Factors), because the comparison considers the path component name but omits the file-type factor.
The exploit is publicly available. The issue is closed on the tracker.
Suggested scoring: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N (6.3, Medium). |
|---|
| Fonte | ⚠️ https://github.com/openclaw/clawscan/issues/40 |
|---|
| Utente | nedlir (UID 95981) |
|---|
| Sottomissione | 16/08/2026 21:18 (1 mese fa) |
|---|
| Moderazione | 15/09/2026 10:26 (30 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 404072 [OpenClaw ClawScan fino a 0.1.6 Static Scanner static_scanner.go] |
|---|
| Punti | 20 |
|---|