Security audit

Openclaw Vault

Security checks across malware telemetry and agentic risk

Overview

This local credential-auditing skill is purpose-aligned, but it needs Review because it reads sensitive files outside the workspace and includes remediation commands that can change, move, or overwrite files without confirmation.

Install only if you want a local credential-auditing tool that can inspect sensitive files. Prefer audit, exposure, inventory, or status first; avoid protect, fix-permissions, quarantine, and unquarantine unless you explicitly want file permissions changed or files moved/restored. Run it in a trusted environment and treat its output as sensitive because it can report paths and masked credential matches from shell history, shell config, and git config.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises commands that invoke a local Python script over a user-supplied or auto-detected workspace and explicitly claims to inspect environment variables, files, and shell-relevant history/config locations, yet it declares no permissions. This creates a transparency and least-privilege problem: an agent may execute a capability-rich skill without an accurate permission declaration, increasing the chance of unexpected access to sensitive local data.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill reads shell history files from the user's home directory (for example ~/.bash_history) in addition to workspace files. That expands data access beyond the declared workspace boundary and can expose highly sensitive credentials unrelated to the target project, which is a dangerous overreach for an agent skill.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code inspects the user's global ~/.gitconfig, not just repository-local .git/config. Global git config can contain credentials and personal account settings unrelated to the workspace, so this broadens access to sensitive user data without a strict need for the core workspace scan.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The exposure checks read shell RC files such as ~/.bashrc and ~/.zshrc from the user's home directory. These files may contain tokens, aliases, functions, and secrets unrelated to the workspace, so the skill gains access to private system-wide data beyond expected project scope.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The README advertises scanning highly sensitive locations such as shell history, git config, log files, and credential files, but it does not warn users that the tool may process or surface secrets during analysis. In an agent-skill context, that omission increases the risk of accidental collection, display, retention, or transmission of credentials by users or downstream tooling that invokes the skill.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The fix-permissions command automatically changes permissions on discovered credential files without any confirmation or dry-run safeguard. In an agent context, this can unexpectedly alter user files, break workflows or shared-access setups, and create integrity or availability issues through unintended file mutation.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The quarantine command moves user-specified files into a quarantine directory immediately and writes metadata, with no confirmation step. Because this removes the original file from its location, it can disrupt builds, deployments, or application startup and is risky for an autonomous skill acting on user repositories.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The unquarantine logic may overwrite an existing file at the original path after only printing a warning, with no hard confirmation barrier. That can destroy or replace legitimate user data and is especially dangerous because matching is permissive, including partial-name matches when selecting the quarantined file.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The protect command performs multiple remediation actions automatically, including permission changes and file quarantine, without explicit per-action confirmation. In a security tool run by an agent, autonomous mutation of user files can cause denial of service to the project, data relocation, and hard-to-review side effects.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.