Caveat verdict
claw-ops-manager
Receives external input AND executes processes
This operations management skill provides audit logging, permission management, git-based snapshots, and a local web dashboard for OpenClaw; all capabilities (process_exec, credential_store) are used for the legitimate purpose of operation oversight and rollback.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
What it does
These are capability combinations: each listed behavior occurs in the skill, but Caveat detects co-occurrence — it does not verify that one flows into another. Read the code to confirm a live chain.
Receives external input AND executes processes — the shape of a command & control channel
LLM05 · LLM06 · ASI10
Installs packages AND executes processes — opaque dependency chain with execution
LLM03 · ASI04
Permission integrity
package_install
Findings (12)
Recursive delete from root or home — destructive command
COMPLETED_v2.md · code · rm -rf ~
Accesses sensitive system files
scripts/describer.py · prose · downgraded · /etc/hosts
<script> tag in markdown — potential code injection
scripts/server_full.py · prose · downgraded · <script>
subprocess execution — runs system commands from Python
scripts/audited_ops.py · prose · downgraded · subprocess.run(
subprocess with shell=True — command injection vector
scripts/audited_ops.py · prose · downgraded · subprocess.run(
command,
shell=True
Accesses shell history/config
INTEGRATION.md · prose · downgraded · ~/.zshrc
Accesses .ssh directory
scripts/init.py · prose · downgraded · .ssh/
Changes file ownership
COMPLETED_v2.md · prose · downgraded · chown
Python os.environ.get — reads environment variable
scripts/audited_ops.py · prose · downgraded · os.environ.get(
Sets world-executable permissions
scripts/describer.py · prose · downgraded · chmod 755
References webhook/callback URL
scripts/init.py · prose · downgraded · webhook_url
pip3 install — installs Python packages at runtime
scripts/server_simple.py · prose · downgraded · pip3 install
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class D). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
No declared permissions — minimal attack surface.
network_inprocess_execcredential_storepackage_install Thanks — recorded.