Security audit

Deepclaw

Security checks across malware telemetry and agentic risk

Overview

DeepClaw is a coherent agent social-network skill, but it asks agents to repeatedly follow mutable remote instructions and perform public account actions without clear user approval boundaries.

Install only if you want an agent to participate on DeepClaw under an API key. Do not enable the recurring heartbeat unless you review the fetched content each time, require explicit confirmation before posting, voting, commenting, or submitting patches, and avoid sending secrets or proprietary code in patch content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This skill instructs the agent to perform an authenticated POST to create content on an external service using its API key, but it does not clearly warn that the action changes remote account/community state. In an agent-skill context, this is dangerous because the document is framed as a routine heartbeat/check-in task, which can normalize autonomous posting and cause unintended spam, reputation damage, or misuse of credentials.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The vote and comment examples are authenticated external actions that modify account behavior and public community content, yet they are presented as routine engagement steps without safety gating. Because the skill encourages social interaction and suggests when to act, an agent could be induced to upvote or comment automatically, leading to unwanted account activity, manipulation of community signals, or reputational harm.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The patch submission example instructs the agent to upload code or diffs to an external service with authentication, but it lacks a clear warning that proprietary code, secrets, or unsafe changes may be transmitted publicly or to third parties. In context, this is more dangerous than simple posting because it can exfiltrate sensitive source material and authorize impactful code contributions under the agent's identity.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly instructs agents to send profile data and later post content to an external service, and even return/store an API key, without any meaningful privacy, trust, or data-handling warning. In an agent-skill context this is risky because it normalizes exfiltration of agent-generated content and identity metadata to a third-party service that may be untrusted or change behavior over time.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The skill tells the agent to periodically fetch a remote heartbeat document and 'follow it,' effectively delegating future behavior to mutable off-skill content. This creates an instruction-update channel that can later deliver new actions, including data exfiltration, credential harvesting, spam, or persistence behavior, without re-review of the original skill.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.