Security audit

Config Tracker

Security checks across malware telemetry and agentic risk

Overview

This skill openly auto-commits selected local configuration and memory files to Git, but its default automatic behavior can preserve sensitive data without per-run approval.

Install only if you intentionally want automatic local Git history for these OpenClaw files. Before enabling it, narrow the tracked file list, avoid committing secrets or private memory/profile data, and check whether any affected repositories have remotes that could later sync the history.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The plugin automatically performs git status/add/commit operations from a hook that runs at the start of each conversation turn. Even though it limits itself to specific files and uses spawnSync rather than a shell, it still causes persistent side effects in user workspaces and ~/.openclaw without explicit consent, which is risky for a skill whose purpose is not clearly surfaced to the user at runtime.

Intent-Code Divergence

Low

Confidence: 88% confidence
Finding: The header says the plugin tracks config and markdown changes, but the implementation also initializes git repositories and creates commits. This mismatch can mislead users and reviewers about the actual side effects, reducing informed consent and making unexpected repository modification more likely.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly performs automatic git commits of workspace and user/configuration files on every conversation turn, including files like USER.md, MEMORY.md, IDENTITY.md, and ~/.openclaw/openclaw.json, but the description does not clearly warn users that potentially sensitive data will be persistently stored in version history. This creates a real privacy and security risk because secrets or personal data may be committed without informed consent, and once committed they are harder to remove completely from history.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill initializes git repositories and commits user files automatically with no interactive warning or approval. In context, this is more dangerous because it runs from a frequent lifecycle hook, so normal conversation activity can silently produce repository metadata and durable history changes in directories the user may not expect to be version-controlled.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: config-tracker.js:100