ClawHub
Back to skill

Security audit

OpenClaw News

Security checks across malware telemetry and agentic risk

Overview

This skill transparently gathers public OpenClaw ecosystem news and stores limited local state for briefings.

Install this if you are comfortable with the agent making public news and registry lookups through GitHub, ClawHub, and search providers, including use of your configured GitHub CLI for read-only API calls. Add the cron entries only if you want recurring briefings; otherwise run it explicitly when needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
90% confidence
Finding
The skill explicitly relies on multiple third-party services and outbound queries, including GitHub, ClawdHub, Brave Search, and possibly Moltbook/Reddit/HN, but it does not clearly warn users that running the skill causes external network access and data sharing with those providers. This is primarily a transparency and privacy issue: users may unknowingly expose their interests, prompts, usage timing, repository targets, or environment metadata to external services.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.