GHSA-cqwv-9qjx-vxw2: OpenClaw: Skill Workshop apply flow could override pending approval

Skill Workshop lets an agent propose changes to skills. With approvalPolicy: pending, a human is meant to approve each change before it takes effect. In affected versions, the tool call carried an apply parameter that the apply path trusted, so the agent's own input overrode the policy (CWE-807). The advisory does not name the tool or the code.

An attacker needs to influence the agent's tool call, for example through a prompt injected in content the agent reads. The CVSS 3.1 vector is network, high complexity, no privileges, with user interaction required, and high integrity impact only. The result is a skill change applied without review. Skills steer what the agent does later, so an unreviewed change can carry later influence over the agent. The real effect depends on which tools and channels reach the Skill Workshop in your setup.

The advisory leaves OpenClaw's trusted-operator model unchanged.

Affected: npm openclaw up to and including 2026.5.5. You are exposed if Skill Workshop is enabled, reachable by an agent, and relies on approvalPolicy: pending.

npm ls -g openclaw

Drop -g for a project install. Check your configuration for the Skill Workshop approval policy.

Update to openclaw 2026.5.6, the first stable patched version.

npm install -g [email protected]

Until you can update, review Skill Workshop changes manually and keep the tool restricted. The advisory also suggests narrow channel and tool allowlists, not sharing one Gateway between mutually untrusted users, and disabling the feature if you do not need it.

The advisory gives no log line. Compare the skills on disk with the changes you approved. Look for skill edits made while the approval policy was pending that no one signed off on. Review agent transcripts for Skill Workshop tool calls that include apply: true. Beam's beam scan can check skill and instruction files for risky patterns, which helps review a changed skill.

Summary

Skill Workshop apply flow could override pending approval. In affected versions, an agent tool call reaching the affected Skill Workshop apply path could set apply: true despite approvalPolicy: pending.

This advisory is scoped to the named feature and configuration. It does not change OpenClaw's trusted-operator model: authenticated Gateway operators, installed plugins, and intentional local execution surfaces remain trusted unless a separate policy, approval, allowlist, sandbox, or auth boundary is crossed.

Impact

When the affected feature is enabled and reachable, this could apply a workshop change before the expected approval step. Practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

Patched Versions

The first stable patched version is 2026.5.6.

Mitigations

review Skill Workshop changes manually and keep the tool restricted until patched. As general hardening, keep channel and tool allowlists narrow, avoid sharing one Gateway between mutually untrusted users, and disable the affected feature when it is not needed.