Openclaw Security

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:34 AM UTC
• Version: 1.0.1

Overview

This security-suite skill is coherent and not malicious, but it can bulk-install, update, execute, and run automated protection tools across a workspace without enough scoping or confirmation safeguards.

Install only if you trust this publisher and the 11 companion tools it manages. Use an explicit workspace path, review the installed tools before running setup or scan, avoid unpinned bulk updates in important workspaces, and do not run protect unless you are prepared for automated changes such as quarantine, blocking, revocation, rotation, rollback, containment, or remediation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = [python, str(script)] + args + ws_args

    try:
        result = subprocess.run(
            cmd,
            capture_output=capture,
            text=True,

• Confidence: 95% confidence
• Finding: result = subprocess.run( cmd, capture_output=capture, text=True, timeout=60, cwd=str(workspace), )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises shell execution and environment access through its documented commands, but it does not declare corresponding permissions. This creates a transparency and consent gap: users or hosting platforms may not realize the skill can execute local commands that install, update, and scan workspace content, increasing the risk of unintended modification or misuse.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README instructs users to install, initialize, update, and optionally run automated countermeasures across 11 tools, but it does not clearly warn that these actions can modify the local environment, install software, change workspace state, or trigger protective actions such as quarantine or rollback. In a security-orchestration skill, users may over-trust the tooling and run commands without understanding the scope of system and workspace changes, increasing the chance of unintended disruptive actions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The install, setup, and update workflows are described as simple commands, but the skill does not warn that they may fetch code/tools and modify the target workspace. In a security-oriented skill, this omission is especially risky because users may assume actions are read-only or harmless, when they could change baselines, policies, signatures, or installed components.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The 'protect' command is presented without a strong warning, even though the surrounding text says Pro tools may block, quarantine, revoke, restore, or enforce changes automatically. Automated countermeasures can disrupt workflows, alter files, revoke access, or isolate content, so failing to disclose that behavior can lead to unexpected and potentially damaging actions in the workspace.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The protect command triggers automated countermeasures across all installed tools without any confirmation prompt, dry-run mode, or explicit warning that files, permissions, credentials, or other workspace state may be changed. In a security orchestration context, bulk remediation can be destructive or disruptive if a workspace contains malicious or misconfigured tools, making accidental execution materially risky.

VirusTotal

58/58 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.