Security audit

Openclaw Warden

Security checks across malware telemetry and agentic risk

Overview

This appears to be a local defensive scanner, but it includes review-worthy commands that can overwrite workspace files or disable skills without confirmation.

Install only if you want a security tool that can do more than report findings. Use verify, scan, full, and status for report-only checks; avoid protect, restore, rollback, and quarantine unless you have reviewed the target files and have backups, because those commands can replace legitimate edits or disable installed skills.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises executable commands and operational behavior that imply shell execution plus file read/write and environment-variable access, but it declares no permissions in metadata. This mismatch can mislead users and tooling about the skill's real capabilities, reducing informed consent and weakening policy enforcement around local file modification and command execution.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The protect workflow claims to restore critical files based on critical injection threats, but the implementation restores all modified critical files regardless of whether injection was detected. This can silently overwrite legitimate changes, causing integrity loss and making the tool dangerous in automated or security-sensitive workflows where preservation of authorized updates matters.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The protect command performs destructive actions such as restore, rollback, and quarantine automatically, without prompting or requiring an explicit opt-in. In an agent skill context, this is riskier because a mistaken scan result or adversarially induced condition could trigger unwanted file overwrites or disable skills, creating denial of service or loss of legitimate workspace state.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The restore command overwrites the destination file immediately from a snapshot with no prior confirmation, backup, or safety check. If invoked on the wrong target or by an automated agent, it can destroy legitimate changes and facilitate denial of service against the workspace's expected state.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The rollback command reverts files to HEAD via git checkout without confirmation or preservation of current content. In practice this can erase legitimate local modifications, and in an agent-managed workspace that can be triggered as an unsafe destructive action with integrity and availability consequences.

VirusTotal

45/45 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: README.md:52

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:93