ClawHub
Back to skill

Security audit

lobster-rank

Security checks for vulnerabilities and agentic risk

Overview

This skill scans local OpenClaw skill metadata and sends it to a leaderboard service for scoring, with no evidence of hidden persistence, destructive behavior, or automatic public posting.

Install only if you are comfortable sending your installed OpenClaw skill metadata, heuristic flags, and Lobster API key to lobster-rank.wondercv.com. Run `--dry-run` first to inspect what will be collected, prefer passing a dedicated Lobster API key with `--api-key`, and confirm public leaderboard upload only when you intend to publish the score.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The manifest claims the config file is read only for authentication and says no other fields are used or transmitted, but later documentation states logs are also scanned for heuristic signals. This creates a data disclosure/transparency gap: users may consent under an incomplete understanding of what local data sources are accessed and what metadata derived from them is sent off-device.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The privacy note narrowly states only the apiKey field from openclaw.json is used, while the rest of the skill describes collecting broader local skill metadata and heuristic signals, including log availability and installed-skill characteristics. Even if raw contents are not uploaded, this is still sensitive host inventory information, and under-disclosure undermines informed consent for exfiltration to a third-party server.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The script pulls an API key from OpenClaw environment/config locations and then sends it as an X-Api-Key to a third-party ranking service. That crosses trust boundaries: a ranking utility should not silently reuse unrelated platform credentials unless those credentials are explicitly designated for the ranking service and the user clearly consents. In this skill context, the capability is more dangerous because the tool also scans local installation state, so it combines local inventory collection with credential reuse for external transmission.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The skill advertises broad trigger terms like score, rate, evaluate, rank, or certify, which can overlap with ordinary user requests and cause over-invocation. In context, this is more concerning because the skill performs local scanning and sends metadata to an external server, so accidental triggering could lead to unintended collection or transmission of environment information.

Static analysis

No suspicious patterns detected.