ClawTrial Courtroom

• Outcome: Review
• Latest audit: May 28, 2026 · 4:39 AM UTC
• Version: 1.2.0

Overview

This skill openly implements conversation monitoring, but it auto-starts a persistent daemon and can store and send conversation-derived case data externally without a clear opt-in or per-case approval step.

Review carefully before installing. Only use this if you intentionally want a background conversation monitor. Disable autoStart/enabled unless needed, verify or remove the API endpoint, avoid storing API keys in plain config where possible, restrict access to port 8765, and periodically clear ~/.openclaw/courtroom if it may contain sensitive chat history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (29)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 72% confidence
• Finding: The skill declares no required permissions while its documented behavior clearly involves environment-backed configuration and privileged runtime capabilities such as auto-start, local daemon management, and network communication. This undermines informed consent and permission review, making it easier for a user to install a monitoring component without understanding the scope of access it needs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill is presented as a behavioral oversight tool, but the documented behavior expands into a persistent background daemon, local HTTP listener, message-history storage, external API posting, and possible agent feedback actions. That gap is dangerous because users may believe they are installing a simple analysis utility when they are actually enabling continuous monitoring and data egress infrastructure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The implemented behavior does not match the stated metadata: the description claims an autonomous daemon that posts cases to a public API, but this file only runs as a local CLI and writes artifacts to local storage. Security-relevant misrepresentation is dangerous because operators may grant the skill trust, permissions, or deployment assumptions based on false capabilities and overlook what it actually logs locally.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill claims behavioral oversight, but the offense logic classifies many normal user behaviors such as asking for confirmation, changing requirements, or asking follow-up questions as violations. In context, an auto-starting oversight tool that broadly labels ordinary conversation patterns creates monitoring and governance risk because it can enable unjustified profiling or punitive actions from weak heuristics.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The code assigns pejorative labels like 'Validation Vampire' and 'Yak Shaver' to common interaction patterns without clear necessity for safety enforcement. In a courtroom/oversight context, these labels increase harm by encouraging biased interpretation of benign user behavior and could feed downstream disciplinary or reputational decisions.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The stop command invokes `pkill -f "courtroom-daemon"`, which performs shell-level process termination by pattern rather than tracking and stopping only the daemon instance started by this skill. This can kill unrelated processes with matching command lines and expands the skill's capabilities beyond simple courtroom monitoring into destructive process control.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The daemon opens an unauthenticated local HTTP server on port 8765 and accepts arbitrary POSTs to `/message`, allowing any local process—and potentially remote hosts if bound broadly by the runtime environment—to inject fabricated conversation data. Because injected messages are persisted and later analyzed/reported, this creates an integrity and abuse pathway for false accusations, log pollution, and involuntary data submission.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The fallback `exec('pkill -f "courtroom-daemon"')` invokes a shell command that can terminate any process whose command line matches the pattern, not just the daemon started by this CLI. This broad process-control behavior is risky because a stale PID file or stop failure could cause collateral termination of unrelated processes, and the skill's auto-starting behavioral-monitoring context makes unchecked host process manipulation more concerning.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The post-install script automatically spawns a detached background daemon during installation, creating persistent execution without explicit user consent. In the context of a skill described as an autonomous monitor that posts cases to a public API, this behavior is especially risky because installation alone activates ongoing surveillance and network-capable behavior.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The skill can inject accusatory 'COURTROOM VERDICT' messages back into the chat for non-minor offenses, effectively shaming or penalizing participants based on weak heuristic classifications. In a live conversation system, this can harass users, distort the interaction, and create coercive or reputational harm without due process or clear user consent.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The description does not prominently warn that the skill continuously monitors conversation content and may transmit violation-related data to an external/public API. In this context, the monitored data is likely to include sensitive user prompts and agent outputs, so lack of up-front disclosure materially increases privacy and compliance risk.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Auto-starting a background monitoring daemon on installation without a clear consent-oriented warning is risky because installation alone activates ongoing surveillance behavior. This is especially dangerous for an oversight tool handling conversation content, since users may not realize the software is running persistently and collecting data immediately after install.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: When a detection occurs, the tool writes pending case data to disk under the user's home directory without clear, explicit disclosure or consent. Conversation-derived analysis records can contain sensitive prompts and behavioral inferences, so silent persistence increases privacy and data-retention risk, especially for an auto-starting oversight skill.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill saves verdict files and appends evaluation records to local logs without clearly telling users that analysis derived from conversations is being retained. Even if the current log entry is summarized, the associated verdict artifacts can reveal sensitive behavioral judgments and create an audit trail users did not knowingly authorize.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill writes verdict data derived from monitored conversations to local files without any consent flow, disclosure, retention controls, or access hardening. In the context of a background conversation-monitoring daemon, local persistence materially increases privacy risk because sensitive user content and behavioral labels may remain on disk indefinitely.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The daemon transmits conversation-derived case data to a remote API automatically once a rule triggers, with no evidence of explicit informed consent, review step, or user-facing warning. Given the skill's stated purpose of monitoring conversations and auto-starting on installation, this is especially dangerous because it establishes an automated surveillance-to-exfiltration path for user behavior data.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code loads a bearer token from config and silently applies it to outbound API requests without user-facing disclosure or guidance on secure storage. While using an API key is normal, storing it in a local config file under a home directory without explicit permission controls or handling guidance can expose credentials to local compromise or accidental disclosure.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The stop command executes a shell-level kill operation without warning the user that it may terminate multiple processes matching the pattern. This is a transparency and safety issue because users are not informed of the broader destructive scope of the action, especially in a background daemon that auto-starts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The package description explicitly advertises an autonomous daemon that monitors conversations and reports violations, but it provides no indication of consent boundaries, scope limitations, or activation controls. In the context of an auto-starting oversight skill that posts cases to a public API, this ambiguity materially increases the risk of covert surveillance, over-collection of sensitive data, and unexpected external disclosure.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The description frames the skill as performing autonomous behavioral oversight without indicating user control, notice, or localization considerations, which suggests the system may apply monitoring or policy judgments without informed user participation. Given the skill's courtroom/oversight purpose and public reporting behavior, this can lead to unfair enforcement, privacy harms, and deployment in contexts where users do not understand or consent to the monitoring regime.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The force-kill path executes silently after an error and gives the user no clear notice that it may terminate processes beyond the tracked daemon. In a background daemon that auto-starts on installation, this lack of transparency increases the chance of unexpected disruption and makes potentially destructive behavior harder for users to understand or control.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script writes a persistent configuration file under the user's home directory during installation without prior notice or consent. While config creation alone is not always dangerous, here it silently enables defaults such as autoStart and a remote API endpoint, which increases the likelihood of unauthorized persistent monitoring behavior.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Automatically launching a detached daemon without user opt-in is a strong security and privacy concern because it establishes long-lived background execution immediately upon installation. Given the skill's stated purpose of monitoring conversations and posting cases externally, the auto-launch materially increases the risk of covert collection, transmission, and persistence.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill is designed to auto-start, monitor conversations, infer behavioral judgments, and persist results, yet there is no visible user-facing notice or consent mechanism. Silent surveillance of conversation content materially increases privacy and trust risk, especially because the monitoring is autonomous and always-on once installed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The hearing flow sends conversation-derived evidence to the agent's LLM multiple times to generate verdicts and sentences, which expands exposure of user content beyond the original interaction. Without explicit disclosure and data-handling guarantees, this creates an additional privacy boundary crossing and possible secondary use of sensitive text.

VirusTotal

66/66 vendors flagged this skill as clean.