ClawHub
Back to skill

Security audit

Openclaw Arbiter

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate local skill auditor, but it includes under-documented commands that can disable or remove installed skills.

Install only if you want a local auditor that can also control your installed skills. Use audit, report, and status for read-only review; back up your skills workspace and be careful with quarantine, protect, and revoke because those commands can disable or remove skills.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill declares no permissions, but its documented functionality explicitly audits other skills for network, subprocess, file I/O, environment variable, and unsafe-operation usage. To do that, the implementation will likely need broad file-read access across the workspace and may itself contain parsing logic that static analysis maps to env, file_write, network, and shell-related capabilities, creating a mismatch between declared and effective permissions. This is dangerous because users and orchestrators may trust the manifest and invoke a skill with broader access than is transparently disclosed.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The revoke command performs destructive removal of a skill from the active workspace and ultimately deletes the original directory tree without any confirmation, dry-run, or force-flag guard. In an agent or automated environment, a mistaken skill name, unsafe wrapper, or unintended invocation can cause irreversible operational loss or denial of functionality.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The automated protection sweep renames skill directories to quarantine them immediately, without a direct user confirmation step. Because this tool operates over a workspace of installed skills, an unexpected or overly broad policy can disable legitimate skills en masse, causing denial of service or disruption to agent behavior.

VirusTotal

53/53 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/arbiter.py:122