Security audit

Goal Task

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-built for OpenClaw scheduled goal reminders, but it uses a local gateway token and creates persistent recurring jobs with under-disclosed credential and cleanup requirements.

Install only if you are comfortable letting this skill use your local OpenClaw gateway token to create, update, and delete scheduled agent jobs. Verify AGENT_SESSION_KEY and FEISHU_GROUP_ID before use, keep every returned jobId, remove jobs promptly after completion, and avoid passing untrusted task text until the script safely encodes inputs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The script reads a gateway authentication token directly from a local credential file and then uses it to perform privileged gateway operations. While cron creation/deletion does require authentication, embedding credential retrieval inside the skill gives the skill autonomous access to a reusable secret and expands its authority beyond the narrow user-supplied inputs, which is risky if the script is modified, reused, or invoked unexpectedly.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill explicitly states that a gateway token is automatically read from a local config file, but it does not clearly warn the user that credentials will be accessed and used. Silent credential consumption is risky because it normalizes implicit secret use and may enable unintended authenticated actions against backend services if the skill is invoked in an unexpected context.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill is designed to create and delete scheduled jobs, but the documentation does not prominently warn that it modifies persistent scheduled-task state on the user's system or platform. This can lead to surprise persistence, repeated execution, and lingering jobs if cleanup fails or the agent does not delete them as expected.

Vague Triggers

Low

Confidence: 89% confidence
Finding: The metadata states that no credentials are required, yet the description says a gateway token is read from ~/.openclaw/openclaw.json at runtime. This is a real security issue because it obscures a sensitive dependency, which can mislead users and reviewers about what secret is accessed and weaken auditability and least-privilege review.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The script silently retrieves a gateway token from a local config file and uses it for remote API calls without any disclosure or explicit consent at invocation time. Even if intended for convenience, hidden credential use reduces operator awareness and makes it easier for the skill to perform privileged actions unexpectedly or in contexts where the user assumes no secret access occurs.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.