ClawHub
Back to skill

Security audit

BailingHub Agent Governance Executor

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built for its stated executor role, but it gives spawned OpenClaw runs broader environment access than users may expect.

Review before installing. Use a dedicated low-privilege service account with a clean environment, avoid placing unrelated API keys or business credentials in that environment, use a target-scoped BailingHub token, and run a non-sensitive one-job test before enabling persistent operation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The spawned OpenClaw process inherits nearly the entire parent environment via `{ ...process.env }`, only removing variables prefixed with `BAILING_`. That means unrelated secrets such as cloud credentials, API keys, database passwords, or CI tokens may be exposed to the child process and, indirectly, to any tools/prompts the child can invoke while processing untrusted jobs from the control plane.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
Job metadata, session identifiers, and `project_path` are copied into the child environment and made available to the OpenClaw run without clear minimization or trust-boundary enforcement. Because jobs are externally supplied and OpenClaw may use tools or prompts that surface environment variables, this can disclose internal paths and sensitive business metadata to downstream components.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/bailinghub-openclaw-executor.mjs:332

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/bailinghub-openclaw-executor.mjs:19