ClawHub
Back to skill

Security audit

Openclaw Triage

Security checks across malware telemetry and agentic risk

Overview

This appears to be a local defensive incident-response tool, but it needs Review because it includes under-disclosed commands that can change a workspace and run other workspace-local tools.

Install only if you intentionally want an active incident-response tool with authority to inspect and modify an agent workspace. Prefer using investigate, timeline, scope, and evidence first; back up the workspace before contain, remediate, or protect; and verify any local OpenClaw helper tools before allowing remediation to run them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (15)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
for d in ("openclaw-signet", "openclaw-signet")]:
        if cand.is_file():
            try:
                r = subprocess.run([sys.executable, str(cand), "sign", "--workspace", str(ws)],
                                   capture_output=True, text=True, timeout=30)
                if r.returncode == 0: actions.append("Re-signed skills"); print("      Done.")
                else: print(f"      Code {r.returncode}")
Confidence
85% confidence
Finding
r = subprocess.run([sys.executable, str(cand), "sign", "--workspace", str(ws)], capture_output=True, text=True, timeout=30)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
for d in ("openclaw-ledger", "openclaw-ledger")]:
        if cand.is_file():
            try:
                r = subprocess.run([sys.executable, str(cand), "record", "--action", "remediation",
                                    "--detail", f"Triage Pro remediation {now_iso()}", "--workspace", str(ws)],
                                   capture_output=True, text=True, timeout=30)
                if r.returncode == 0: actions.append("Recorded in ledger"); print("      Done.")
Confidence
85% confidence
Finding
r = subprocess.run([sys.executable, str(cand), "record", "--action", "remediation", "--detail", f"Triage Pro remediation {now_iso()}", "--workspace"

subprocess module call

Medium
Category
Dangerous Code Execution
Content
for d in ("openclaw-warden", "openclaw-warden")]:
        if cand.is_file():
            try:
                r = subprocess.run([sys.executable, str(cand), "scan", "--workspace", str(ws)],
                                   capture_output=True, text=True, timeout=60)
                if r.returncode == 0: actions.append("Rebuilt baselines"); print("      Done.")
                else: print(f"      Code {r.returncode}")
Confidence
85% confidence
Finding
r = subprocess.run([sys.executable, str(cand), "scan", "--workspace", str(ws)], capture_output=True, text=True, timeout=60)

Tainted flow: 'ws' from os.environ.get (line 78, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
for d in ("openclaw-signet", "openclaw-signet")]:
        if cand.is_file():
            try:
                r = subprocess.run([sys.executable, str(cand), "sign", "--workspace", str(ws)],
                                   capture_output=True, text=True, timeout=30)
                if r.returncode == 0: actions.append("Re-signed skills"); print("      Done.")
                else: print(f"      Code {r.returncode}")
Confidence
79% confidence
Finding
r = subprocess.run([sys.executable, str(cand), "sign", "--workspace", str(ws)], capture_output=True, text=True, timeout=30)

Tainted flow: 'ws' from os.environ.get (line 78, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
for d in ("openclaw-ledger", "openclaw-ledger")]:
        if cand.is_file():
            try:
                r = subprocess.run([sys.executable, str(cand), "record", "--action", "remediation",
                                    "--detail", f"Triage Pro remediation {now_iso()}", "--workspace", str(ws)],
                                   capture_output=True, text=True, timeout=30)
                if r.returncode == 0: actions.append("Recorded in ledger"); print("      Done.")
Confidence
79% confidence
Finding
r = subprocess.run([sys.executable, str(cand), "record", "--action", "remediation", "--detail", f"Triage Pro remediation {now_iso()}", "--workspace"

Tainted flow: 'ws' from os.environ.get (line 78, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
for d in ("openclaw-warden", "openclaw-warden")]:
        if cand.is_file():
            try:
                r = subprocess.run([sys.executable, str(cand), "scan", "--workspace", str(ws)],
                                   capture_output=True, text=True, timeout=60)
                if r.returncode == 0: actions.append("Rebuilt baselines"); print("      Done.")
                else: print(f"      Code {r.returncode}")
Confidence
79% confidence
Finding
r = subprocess.run([sys.executable, str(cand), "scan", "--workspace", str(ws)], capture_output=True, text=True, timeout=60)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises and instructs execution of a local Python script that reads environment variables, scans and hashes workspace files, copies security-tool data, and writes evidence/output artifacts, yet it declares no permissions. This creates a capability/permission mismatch that can mislead users or enforcement systems about the skill’s actual access, especially given the highly sensitive incident-response context where broad file and metadata access is expected.

Description-Behavior Mismatch

Medium
Confidence
76% confidence
Finding
The documentation says the free tier is investigation-only, but free commands persist state and can write evidence artifacts into the workspace. This mismatch can mislead users and downstream agents into assuming read-only behavior, causing unintended modification of a possibly sensitive or forensic workspace.

Description-Behavior Mismatch

High
Confidence
88% confidence
Finding
The file presents itself as a triage suite but includes active containment, remediation, hook disabling, file restoration, and baseline rebuilding. This capability mismatch is dangerous because users may grant it trust appropriate for diagnostics while it can perform destructive security-sensitive changes and execute additional code.

Context-Inappropriate Capability

High
Confidence
90% confidence
Finding
Executing other local Python tools during remediation materially expands the skill's authority beyond analysis. In the context of an incident-response skill operating on an untrusted workspace, this creates a strong code-execution risk because those local tools may be attacker-modified.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README explicitly states that evidence collection snapshots the full workspace and copies all security-tool data, which can include secrets, private source code, user data, and sensitive audit artifacts. Even though this is framed as legitimate forensic behavior, the lack of a clear privacy/data-sensitivity warning, scope controls, or guidance on secure storage increases the risk of accidental over-collection and secondary exposure.

Missing User Warnings

High
Confidence
94% confidence
Finding
Containment automatically copies and then deletes entire skill directories (`shutil.rmtree(sd)`) based on heuristic findings, without any confirmation prompt. In a false-positive scenario or when findings are attacker-influenced, this can destroy or disrupt legitimate workspace functionality and tamper with evidence.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The tool disables Claude hook configuration files by renaming them automatically when commands like `curl`, `wget`, or `nc` appear. This changes security-sensitive configuration without user approval and may break legitimate workflows or incident instrumentation.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
Remediation executes other scripts without a strong safety boundary or explicit approval, which is especially risky in a compromised workspace. Users invoking a remediation command may not realize it can trigger arbitrary code paths in dependent local tools.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
if cmd: print(f"  Command: python3 triage.py {cmd}")
        print()
    print(f"{'='*60}\nPlaybook: {scenario} | Steps: {len(pb['steps'])}")
    print(f"Auto-execute containment: triage.py protect\n{'='*60}")

def cmdtect(ws):
    print("=" * 60); print("AUTOMATED FULLTECTION SWEEP"); print("=" * 60)
Confidence
72% confidence
Finding
Auto-execute

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.