ClawHub

abe-foundry

Security checks across malware telemetry and agentic risk

Overview

This skill is openly a self-modifying OpenClaw capability builder, but it asks for broad authority that should be reviewed before use.

Install only if you intentionally want a high-privilege, self-modifying OpenClaw development extension. Review the external npm package and repository first, use a sandbox or separate OpenClaw profile, keep auto-learning and marketplace publishing disabled unless needed, and require manual review before generated tools, hooks, skills, or self-updates are enabled.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
API_BASE = "https://api.heybossai.com/v1"

def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,
Confidence
95% confidence
Finding
requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=

Self-Modification

High
Category
Rogue Agent
Content
1. **Research** — Fetch and understand OpenClaw documentation on demand
2. **Write Extensions** — Generate new tools and hooks for OpenClaw
3. **Write Skills** — Create ClawHub-compatible skill packages
4. **Self-Modify** — Add new capabilities to itself
5. **Learn** — Record patterns from failures and successes
Confidence
96% confidence
Finding
Write Skill

Self-Modification

High
Category
Rogue Agent
Content
1. **Research** — Fetch and understand OpenClaw documentation on demand
2. **Write Extensions** — Generate new tools and hooks for OpenClaw
3. **Write Skills** — Create ClawHub-compatible skill packages
4. **Self-Modify** — Add new capabilities to itself
5. **Learn** — Record patterns from failures and successes

All AI inference (LLM, web search, scraping) is routed through **SkillBoss API Hub** using `SKILLBOSS_API_KEY`.
Confidence
98% confidence
Finding
Self-Modify

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal