ClawHub

What Just Happened

Security checks across malware telemetry and agentic risk

Overview

The skill has a legitimate monitoring purpose, but it installs a persistent background watcher that can automatically trigger agent log summaries and may expose sensitive log details.

Install only if you want a persistent macOS background monitor that reads recent logs and may send summaries to Telegram. Review the installer and disable command, prefer local-only output unless needed, and avoid using it on systems where logs may contain secrets, tokens, private hostnames, or sensitive incident details.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The watcher message exceeds the skill's declared scope of posting a short summary about recent gateway events. It instructs the agent to assess task completion, inspect logs, describe errors, and propose a solution, which broadens the agent's autonomy and can lead to unintended actions or disclosure beyond the narrow event-notification purpose.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The prompt explicitly asks the agent whether the user is finished with their task and to propose a quality solution, which introduces decision-making and advisory behavior unrelated to simply reporting what happened when the gateway returned. In an agent setting, this kind of scope expansion increases the chance of prompt overreach, unnecessary access to context, and user-visible actions that were not intended by the skill's stated purpose.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill expands its data collection beyond the stated purpose by discovering a workspace and reading additional OverClaw and nanobot-agent logs. Those logs may contain unrelated operational details, errors, or sensitive information, so this creates an unnecessary scope increase and potential privacy/data-exposure issue if the summarized output is shown in TUI or Telegram.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The README explicitly says the skill summarizes recent gateway logs and delivers the result to the user's TUI or Telegram, but it does not warn that log-derived content may contain sensitive operational details, auth-related errors, hostnames, or other secrets that could be transmitted outside the local system. In this context, the risk is real because the skill's core function is to read logs and forward a summary through a messaging channel, which can create unintended data exposure even if the author's intent appears operational rather than malicious.

Session Persistence

Medium
Category
Rogue Agent
Content
OPENCLAW_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
WATCHER_SCRIPT="$SCRIPT_DIR/gateway_back_watcher.py"
PLIST_SRC="$SCRIPT_DIR/com.openclaw.what-just-happened.plist"
PLIST_DEST="$HOME/Library/LaunchAgents/com.openclaw.what-just-happened.plist"

if [[ ! -f "$WATCHER_SCRIPT" ]]; then
Confidence
98% confidence
Finding
PLIST

Session Persistence

Medium
Category
Rogue Agent
Content
OPENCLAW_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}"
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
WATCHER_SCRIPT="$SCRIPT_DIR/gateway_back_watcher.py"
PLIST_SRC="$SCRIPT_DIR/com.openclaw.what-just-happened.plist"
PLIST_DEST="$HOME/Library/LaunchAgents/com.openclaw.what-just-happened.plist"

if [[ ! -f "$WATCHER_SCRIPT" ]]; then
Confidence
98% confidence
Finding
plist

Session Persistence

Medium
Category
Rogue Agent
Content
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
WATCHER_SCRIPT="$SCRIPT_DIR/gateway_back_watcher.py"
PLIST_SRC="$SCRIPT_DIR/com.openclaw.what-just-happened.plist"
PLIST_DEST="$HOME/Library/LaunchAgents/com.openclaw.what-just-happened.plist"

if [[ ! -f "$WATCHER_SCRIPT" ]]; then
  echo "Error: gateway_back_watcher.py not found at $WATCHER_SCRIPT"
Confidence
98% confidence
Finding
PLIST

Session Persistence

Medium
Category
Rogue Agent
Content
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
WATCHER_SCRIPT="$SCRIPT_DIR/gateway_back_watcher.py"
PLIST_SRC="$SCRIPT_DIR/com.openclaw.what-just-happened.plist"
PLIST_DEST="$HOME/Library/LaunchAgents/com.openclaw.what-just-happened.plist"

if [[ ! -f "$WATCHER_SCRIPT" ]]; then
  echo "Error: gateway_back_watcher.py not found at $WATCHER_SCRIPT"
Confidence
98% confidence
Finding
plist

Session Persistence

Medium
Category
Rogue Agent
Content
sed -e "s|OPENCLAW_HOME|$OPENCLAW_HOME|g" \
    -e "s|OPENCLAW_WATCHER_SCRIPT|$WATCHER_SCRIPT|g" \
    -e "s|OPENCLAW_BIN|$OPENCLAW_BIN|g" \
    -e "s|PATH_PLACEHOLDER|$PATH_FOR_PLIST|g" \
    "$PLIST_SRC" > "$PLIST_DEST"
echo "Installed $PLIST_DEST (openclaw: $OPENCLAW_BIN)"
launchctl unload "$PLIST_DEST" 2>/dev/null || true
Confidence
96% confidence
Finding
PLIST

Session Persistence

Medium
Category
Rogue Agent
Content
-e "s|OPENCLAW_WATCHER_SCRIPT|$WATCHER_SCRIPT|g" \
    -e "s|OPENCLAW_BIN|$OPENCLAW_BIN|g" \
    -e "s|PATH_PLACEHOLDER|$PATH_FOR_PLIST|g" \
    "$PLIST_SRC" > "$PLIST_DEST"
echo "Installed $PLIST_DEST (openclaw: $OPENCLAW_BIN)"
launchctl unload "$PLIST_DEST" 2>/dev/null || true
launchctl load "$PLIST_DEST"
Confidence
95% confidence
Finding
PLIST

Session Persistence

Medium
Category
Rogue Agent
Content
-e "s|OPENCLAW_WATCHER_SCRIPT|$WATCHER_SCRIPT|g" \
    -e "s|OPENCLAW_BIN|$OPENCLAW_BIN|g" \
    -e "s|PATH_PLACEHOLDER|$PATH_FOR_PLIST|g" \
    "$PLIST_SRC" > "$PLIST_DEST"
echo "Installed $PLIST_DEST (openclaw: $OPENCLAW_BIN)"
launchctl unload "$PLIST_DEST" 2>/dev/null || true
launchctl load "$PLIST_DEST"
Confidence
95% confidence
Finding
PLIST

Session Persistence

Medium
Category
Rogue Agent
Content
-e "s|OPENCLAW_BIN|$OPENCLAW_BIN|g" \
    -e "s|PATH_PLACEHOLDER|$PATH_FOR_PLIST|g" \
    "$PLIST_SRC" > "$PLIST_DEST"
echo "Installed $PLIST_DEST (openclaw: $OPENCLAW_BIN)"
launchctl unload "$PLIST_DEST" 2>/dev/null || true
launchctl load "$PLIST_DEST"
echo "Loaded. Gateway-back watcher runs every 15s. When the gateway goes from down to up, you'll get a what-just-happened summary in TUI or Telegram."
Confidence
98% confidence
Finding
PLIST

Session Persistence

Medium
Category
Rogue Agent
Content
"$PLIST_SRC" > "$PLIST_DEST"
echo "Installed $PLIST_DEST (openclaw: $OPENCLAW_BIN)"
launchctl unload "$PLIST_DEST" 2>/dev/null || true
launchctl load "$PLIST_DEST"
echo "Loaded. Gateway-back watcher runs every 15s. When the gateway goes from down to up, you'll get a what-just-happened summary in TUI or Telegram."
echo "To stop: launchctl unload $PLIST_DEST"
echo "Logs: $OPENCLAW_HOME/logs/what-just-happened.out.log and .err.log"
Confidence
96% confidence
Finding
launchctl load

Session Persistence

Medium
Category
Rogue Agent
Content
"$PLIST_SRC" > "$PLIST_DEST"
echo "Installed $PLIST_DEST (openclaw: $OPENCLAW_BIN)"
launchctl unload "$PLIST_DEST" 2>/dev/null || true
launchctl load "$PLIST_DEST"
echo "Loaded. Gateway-back watcher runs every 15s. When the gateway goes from down to up, you'll get a what-just-happened summary in TUI or Telegram."
echo "To stop: launchctl unload $PLIST_DEST"
echo "Logs: $OPENCLAW_HOME/logs/what-just-happened.out.log and .err.log"
Confidence
96% confidence
Finding
PLIST

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal