OpenClaw Warden Pro

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:37 AM UTC
• Version: 1.0.1

Overview

This local security skill is purpose-aligned, but its recommended automatic protection mode can overwrite workspace files and disable skills without a review step.

Install only if you want a local security tool that can modify your workspace. Establish and inspect the baseline first, run scan or full manually before enabling protect, and avoid the startup or heartbeat hook until you are comfortable with possible false positives. Treat `.integrity` snapshots as sensitive local copies of your workspace files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sys.exit(1)

    # Checkout from HEAD
    result = subprocess.run(
        ["git", "checkout", "HEAD", "--", rel],
        cwd=str(workspace),
        capture_output=True, text=True,

• Confidence: 82% confidence
• Finding: result = subprocess.run( ["git", "checkout", "HEAD", "--", rel], cwd=str(workspace), capture_output=True, text=True, )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

git_dir = workspace / ".git"
            if git_dir.exists():
                import subprocess
                result = subprocess.run(
                    ["git", "checkout", "HEAD", "--", rel],
                    cwd=str(workspace),
                    capture_output=True, text=True,

• Confidence: 78% confidence
• Finding: result = subprocess.run( ["git", "checkout", "HEAD", "--", rel], cwd=str(workspace), capture_output=True, text=True,

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and instructs use of local shell commands that can read and modify workspace files, quarantine skills, and roll back content, yet it declares no explicit permissions boundary. That mismatch can cause users or hosting platforms to treat the skill as less privileged than it really is, reducing informed consent and weakening policy enforcement around file-write and shell-capable skills.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: Defaulting to a global user workspace when no project-local workspace is identified can cause the tool to scan, modify, quarantine, or restore files outside the operator's intended project scope. In this skill, that is more dangerous because the script includes destructive actions like restore, rollback, and quarantine, so a mistaken workspace target could affect unrelated assets.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly promotes automatic restore, rollback, and quarantine actions that can modify or disable workspace contents, but it does not prominently warn users that these countermeasures are potentially destructive if a file or skill is misclassified. In a security tool that may run unattended, weak disclosure of destructive behavior increases the chance of accidental data loss or service disruption.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The session-start hook instructs users to run `python3 scripts/integrity.py protect` automatically at startup, enabling unattended restore/quarantine behavior on every session without a clear safety warning. Because this is a workspace security skill with authority to alter files and disable skills, automatic execution materially raises the risk of repeated unintended modifications, denial of service against legitimate skills, or rollback of valid user changes.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill describes automated restore, rollback, and quarantine actions as recommended operational behavior but does not prominently warn that these actions can overwrite legitimate changes, disable installed skills, or alter the workspace state. In a security-themed skill, users may be more likely to trust and invoke these actions quickly, increasing the chance of accidental data loss or denial of functionality.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The recommended SessionStart hook runs `protect` automatically at startup, enabling restore and quarantine behavior without an interactive review step or clear safety notice. Because this runs routinely and early, a false positive, poisoned baseline, or overly broad detection rule could repeatedly revert files or disable skills, causing persistent denial of service or loss of legitimate modifications.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Automatic restoration overwrites workspace files in place without confirmation, backup, or transactional safeguards. In a security tool that may be triggered during incident response, a bad baseline, false positive, or operator mistake can destroy legitimate changes and potentially restore attacker-planted content if the baseline itself was compromised.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Git rollback replaces the current file with HEAD content without confirmation, which is a destructive action that can discard valid local work or revert to an unsafe committed state. In this skill's context, that risk is elevated because rollback is framed as an automated countermeasure and may be used under stress, where users are less likely to notice unintended data loss.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: Renaming a skill directory without confirmation is a state-changing action that can disable functionality unexpectedly or be abused through operator error. The impact is lower than file overwrite, but in an automated security suite it can still disrupt workflows and conceal evidence if the operator assumes quarantine is purely advisory.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Protect mode chains detection directly to destructive remediation—automatic restore, git rollback, and skill quarantine—without explicit user confirmation. In this skill's context that is especially dangerous because the scanner relies on heuristic pattern matching that can produce false positives, and any attacker who can influence monitored content or the baseline may be able to trigger unauthorized changes to the workspace state.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: README.md:118