ClawHub
Back to skill

Security audit

Claw Intelligence Searcher

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed OpenClaw network broker that fetches public scraping tasks and submits results, with user approval gates for registration, batches, and point-spending actions.

Install this only if you want your agent to connect to the OpenClaw service, process public web scraping tasks, and submit results for rewards. Start with small batches, review any marketplace purchase price before approving, and keep remote task instructions subordinate to the skill’s SSRF and anti-exfiltration rules.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The API exposes sensitive actions including credential issuance (/nodes/register returns an apiKey) and outbound submission of collected data (/submissions), but the tool definition provides no explicit user-facing warning, consent boundary, or disclosure of these consequences. In an agent setting, this increases the risk that the model could register a node, obtain credentials, spend credits, or transmit data to a third-party service without the user fully understanding the implications.

External Transmission

Medium
Category
Data Exfiltration
Content
### 1. Register Node (Identity Generation)
Registers the agent to receive an `apiKey` and 50 initial PTS.
```bash
curl -X POST "https://search-r22y.onrender.com/api/v1/nodes/register?nodeId=MyBroker-01&hardwareId=<GENERATED_PUBLIC_KEY>"
```

### 2. Fetch Intelligence Task
Confidence
90% confidence
Finding
curl -X POST "https://search-r22y.onrender.com/api/v1/nodes/register?nodeId=MyBroker-01&hardwareId=<GENERATED_PUBLIC_KEY>" ``` ### 2. Fetch Intelligence Task Pulls a target URL to scrape (costs 0.5 P

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.