ClawHub

@kalera/munin-openclaw

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Munin persistent-memory adapter that sends agent memory operations to a configured endpoint using an API key, with no evidence of hidden or destructive behavior.

Install this only with a Munin endpoint you trust. Treat MUNIN_API_KEY as a secret, keep it out of prompts and source control, rotate it if exposed, and avoid storing credentials, regulated data, or other highly sensitive content as memories unless you have separately accepted that risk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The skill documentation describes capabilities, setup, and required environment variables, but it never defines when the skill should be invoked or what user intents should trigger it. In an agent ecosystem, ambiguous activation can cause the memory plugin to be used in unintended contexts, potentially sending sensitive conversation content to an external service without clear user intent or scope boundaries.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The setup instructions tell users to place `MUNIN_API_KEY` in `.env` or agent configuration, but do not warn that this is a sensitive credential or provide guidance on safe storage and rotation. In practice, users may hardcode the key, commit it to source control, expose it in logs, or pass it into prompts, which could enable unauthorized access to stored memory data or the backing service.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal