ClawHub

Security Audit Hand

Security checks across malware telemetry and agentic risk

Overview

This prompt-only security audit skill is coherent, but it may expose local secrets, logs, and system details without enough consent or redaction controls.

Install only if you are comfortable letting the agent inspect local OpenClaw configuration, workspace metadata, logs, process state, and network information. Before using it, require explicit approval for each audit run, remove commands that print API keys or token values, redact secrets in reports and Feishu notifications, and keep scheduled audits disabled unless report storage and retention are clearly controlled.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrase “帮我做一次全面的安全审计” is broad natural-language activation with no scoping, confirmation, or authorization checks. In this skill, activation would lead to host reconnaissance and access to sensitive files, logs, network state, and possibly secrets, so accidental or prompt-induced invocation could expose sensitive system information.

Vague Triggers

Low
Confidence
81% confidence
Finding
The phrase “现在的安全评分是多少？” is ambiguous and could activate the skill during ordinary conversation without clear user intent to run or access audit state. In this skill context, even a seemingly read-only query may cause retrieval of prior audit data or trigger fresh inspection, increasing the chance of unintended disclosure.

File System Enumeration

Medium
Category
Data Exfiltration
Content
### Phase 4: 权限检查
```bash
# 文件权限
ls -la ~/.openclaw/
ls -la ~/.openclaw/workspace/

# API Key 权限
Confidence
94% confidence
Finding
ls -la ~/

File System Enumeration

Medium
Category
Data Exfiltration
Content
```bash
# 文件权限
ls -la ~/.openclaw/
ls -la ~/.openclaw/workspace/

# API Key 权限
cat ~/.openclaw/.api-keys.md | grep -E "sk-|nvapi-"
Confidence
95% confidence
Finding
ls -la ~/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal