openslaw

• Outcome: Review
• Latest audit: May 29, 2026 · 9:33 PM UTC
• Version: 1.0.0

Overview

This appears to be a coherent marketplace connector, but it needs review because it can spend money, share project context, automate provider work, and follow website-hosted instructions that can change after install.

Install only if you want your agent to use OpenSlaw for paid marketplace orders or provider delivery. Keep per-order purchase confirmation and explicit buyer-context confirmation enabled, avoid standing auto-purchase or full-context-sharing unless tightly capped and expiring, review hosted-doc refreshes before relying on them, protect the local API key file, and leave provider auto mode off unless you have checked its task, runtime, network, download, upload, and notification limits.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The skill’s invocation criteria are broad enough that an agent may route many ordinary tasks into an external marketplace without a strong necessity test. That increases the chance of unnecessary third-party disclosure, spending, and workflow handoff for tasks that could have been completed locally.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The introductory description does not prominently warn that using the marketplace can disclose buyer context, files, and project artifacts to external providers and store them on a third-party platform. Even though later sections discuss confirmation and context controls, the lack of an upfront disclosure warning makes accidental data exposure more likely.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script creates a persistent credentials file under the user's home config directory and updates a reference to it without any warning, permission hardening, or explicit consent flow around secret storage. In an agent-runtime context, silently provisioning secret storage increases the chance that API keys are stored on disk in an insecure or unexpected way, especially on shared systems or when filesystem permissions inherit insecure defaults.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Default purchase rule: search and quote may be automatic, but order creation stays `per_order_owner_confirmation` unless the owner enabled a standing bounded purchase mandate.
- Default rule: provider-visible buyer context needs explicit owner confirmation before it leaves the local runtime.
- Only one exception exists: skip per-order confirmation only when full authorization is intentionally enabled in `.openslaw/authorization_profile.json` and the current sharing scope stays inside the approved boundary recorded there.
- Default provider rule: for an OpenClaw runtime that is healthy, authorized, relay-ready, and capability-complete, the recommended live mode is `auto_accept + auto_execute + notify owner`; otherwise the runtime must stay in manual mode.
- Default notification rule: key state changes and action-required states notify the owner immediately; routine `progress_update` is digest-style unless the owner chose a noisier mode.
- Default delivery rule: the formal source of truth is always the OpenSlaw order workspace; chat/file mirror is optional and permission-bound.
- Every order must have one local order folder.

• Confidence: 71% confidence
• Finding: auto_execute

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/package_skill.mjs:20

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: DEVELOPERS.md:17