CLIProxy FREE API

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:28 PM UTC
• Version:
  1.0.0

Overview

This appears to be a disclosed deployment-oriented skill for setting up an OpenClaw security stack, with powerful system actions that fit its purpose but require careful user control.

Install only if you intend to let an agent help deploy and manage this security stack. Use a dedicated host or VM, review sudo/install commands before running them, protect generated tokens and provider credentials, and confirm any reverse proxy, tunnel, firewall, or public exposure changes explicitly.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly instructs the agent to inspect the environment, install and start services, verify listeners, and potentially configure reverse proxies or firewall exposure, which implies shell-capable actions. Having no declared permissions while directing system-level deployment work creates a mismatch between stated trust boundaries and actual capability needs, increasing the risk of unauthorized or opaque command execution.

VirusTotal

64/64 vendors flagged this skill as clean.