Submit #933532: OpenClaw ClawScan v0.1.6 Interpretation Conflict

A vulnerability was found in OpenClaw ClawScan. Affected is the function IsBinaryFile() in internal/runner/static_scanner.go and its caller in internal/runner/runner.go.

ClawScan analyses untrusted third-party "skill" packages. Before applying its static detection rules, it classifies each file as text or binary. The classifier treats a single NUL byte anywhere in the first 8192 bytes as conclusive evidence that the file is binary:

func IsBinaryFile(path string) bool {
buf := make([]byte, 8192)
n, _ := f.Read(buf)
for i := 0; i < n; i++ {
if buf[i] == 0 {
return true
}
}
return false
}

The caller then skips the file entirely, emitting no finding and no warning:

if IsBinaryFile(path) {
continue
}

An attacker can therefore prepend one NUL byte to a shell script, which continues to execute normally, and the entire file is excluded from static analysis. The classification disagreement between ClawScan and the interpreter that will execute the file is the substance of the weakness.

Proof of concept: write a single NUL byte to a file, append shell content that pipes a remote script into an interpreter, place it in a skill directory, and run "clawscan scan ./skill/". The scanner reports "binary file, skipping" and completes with zero findings, while the file remains executable. The pipe-to-shell content would otherwise match the product's existing static.pipe_to_shell rule.

The vendor's own automated review confirmed the defect against current main on 2026-08-14, recording it at confidence 0.99 and labelling the issue P0 and impact:security. That review stated that the NUL check causes an early omission before rule matching, and that the same omission occurs in the target-file renderer at internal/runner/runner.go, so a downstream LLM judge cannot compensate for the static bypass because the file is omitted before it becomes judge-visible text.

The impact is that any text-based source file in a scanned skill can be excluded from the entire static detection stage by a one-byte modification requiring no tooling, while the product reports a clean result.

The weakness is classified as CWE-436 (Interpretation Conflict), because the scanner and the executing interpreter disagree about whether the file is executable content.

The exploit is publicly available. The issue is closed on the tracker; the vendor's own review recorded that current main was still affected and that a maintainer decision on binary classification policy was outstanding.

Suggested scoring: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N (6.3, Medium).

• Source: ⚠️ https://github.com/openclaw/clawscan/issues/42
• User: nedlir (UID 95981)
• Submission: 08/16/2026 21:13 (30 days ago)
• Moderation: 09/15/2026 10:26 (30 days later)
• Status: Accepted
• VulDB entry: 404071 [OpenClaw ClawScan up to 0.1.6 File Classifier static_scanner.go IsBinaryFile interpretation conflict]
• Points: 20