ClawHub
Back to skill

Security audit

Chart MPL

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward local chart-generation skill with a normal Python setup step and no evidence of hidden or unrelated behavior.

Install this if you want local CSV-to-chart generation. Review the setup command before running it, use a trusted Python package source, and only point it at CSV files and output paths you intend to use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
## Setup

Create a virtual environment and install matplotlib (one-time):

```bash
python3 -m venv ~/.openclaw/workspace/.venv_chart
Confidence
72% confidence
Finding
The skill instructs users to create a persistent virtual environment and install packages into a long-lived workspace path. Persistent setup can introduce supply-chain and integrity risks over time because later runs may implicitly trust previously installed packages or modified environment state, making behavior less reproducible and easier to tamper with.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.