ClawHub
Back to skill

Security audit

Openclaw Sentinel

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real local security scanner, but it includes under-disclosed commands that can disable or move other installed skills.

Install only if you want a security tool that can also manage other installed skills. Use scan, inspect, threats, and status first, pass an explicit --workspace path, import threat lists only from trusted sources, and avoid quarantine, reject, or protect unless you intentionally want the tool to disable or move skill directories and have backups.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises commands that can read and write files, access environment variables, invoke shell commands, and potentially process externally supplied threat data, but it declares no permissions in the skill metadata. That mismatch is dangerous because users and hosting platforms cannot accurately assess or constrain what the skill is capable of before invocation, increasing the chance of unsafe execution in sensitive workspaces.

Intent-Code Divergence

High
Confidence
93% confidence
Finding
The docstring claims scanning mode only alerts, but the file also implements active modification commands such as quarantine, reject, and automated protect flows that rename or move skill directories. This is dangerous because operators or higher-level agents may trust the stated behavior and invoke the tool in contexts where only read-only analysis was expected, leading to unintended state-changing actions.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The reject path performs a destructive move of a skill directory into an evidence area without any interactive confirmation, dry-run gate, or secondary safety check. In agent or automation contexts, a mistaken invocation, name confusion, or manipulated workflow could remove an installed skill unexpectedly and disrupt the workspace.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The automated protect flow quarantines skills by renaming directories solely based on computed risk score, with no explicit user approval at execution time. This creates a real integrity and availability risk because false positives, crafted inputs, or unexpected scan results can automatically disable installed skills in bulk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/sentinel.py:44