Security audit

Openclaw Ledger

Security checks across malware telemetry and agentic risk

Overview

This appears to be a local audit-ledger skill whose file changes are tied to its stated security purpose, with some documentation and operator-control caveats.

Install only if you want a local audit ledger that records workspace state under .ledger. Treat the ledger directory as sensitive, exclude secrets where possible, and avoid running restore/protect on important workspaces until you understand whether it will reset session baselines or replace active ledger files from backups.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill exposes shell execution and workspace read/write behavior through documented commands, but declares no permissions to inform the host or user of those capabilities. This creates a security transparency gap: users may invoke a skill that can modify files and inspect workspace contents without an explicit permission declaration, increasing the chance of unintended or unsafe use.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The restore routine is documented as restoring only the chain, but it also overwrites session state by creating a fresh workspace snapshot and rewriting session.json. This hidden side effect can erase the previous baseline used for change tracking, making subsequent auditing inaccurate and potentially concealing workspace modifications after a restore.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The protection sweep claims to perform verification and protection actions, but on tamper detection it automatically copies backup files over the active chain and appends a new entry. This is a materially destructive state change hidden behind a defensive-sounding command, which can surprise operators, destroy forensic context in the active chain, and be abused to roll back ledger state without explicit approval.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README explicitly claims to create hash-chained logs of every workspace change, but it does not warn users that such logging may capture sensitive source code, secrets, file paths, or other private workspace metadata. In an agent-skill context, comprehensive change recording can expose high-value data to anyone with ledger access or to downstream backups, making the omission of privacy and data-handling guidance a real security concern.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: When tampering is detected, the code freezes evidence and may restore the chain automatically, all without any confirmation prompt or explicit opt-in. In a security tool operating on audit artifacts, silent file modification is risky because it can overwrite the current investigative state, trigger unintended recovery actions, and reduce operator control during incident response.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.