ClawHub
Back to skill

Security audit

Openclaw Switch

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-aligned, but its local switching script has a real code-injection risk when handling crafted OpenClaw configuration values.

Review the script before installing, back up ~/.openclaw/openclaw.json, and use it only with trusted config files and model IDs. Prefer a patched version that passes paths and model IDs to Python through argv or environment variables instead of interpolating them into python3 -c source strings.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares no permissions, but its documented commands and metadata expose a script that reads and modifies OpenClaw configuration, which implies file read/write capability. This mismatch can mislead users and reviewers about what the skill can access, reducing transparency and weakening security controls around configuration files that may contain sensitive provider settings or API keys.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README instructs users to append to ~/.zshrc and immediately source it, which creates a persistent environment change without clearly warning that it modifies the user's shell startup configuration. In a skill context, encouraging copy-paste of profile-changing commands can lead to unintended PATH precedence changes, make later troubleshooting harder, and normalize unsafe execution habits even if the specific command is not overtly malicious.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.