ClawHub
Back to skill

Security audit

Skill Audit

Security checks for vulnerabilities and agentic risk

Overview

This skill audits local OpenClaw skill files and its file reads and report output are disclosed and aligned with that purpose, with only minor documentation overstatement.

Install only if you want an agent to inspect your local OpenClaw skill directories and create an audit report. Review the generated .sub-agent-results report before sharing it, because it may include local paths, skill names, and metadata about your setup.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code does perform a skill audit function, so the description is directionally related. However, the declared purpose overstates the implemented capabilities. The script mainly gathers a limited set of heuristics about skill metadata and layout and scores them. It does not implement duplicate detection, and its structural/best-practice checks are much narrower than the description suggests. Additionally, the script comment claims JSONL output, but the actual output is a header plus pipe-delimited rows and an orphan section. This is a meaningful description-to-behavior mismatch, though not a completely unrelated one.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

An overly broad trigger phrase can cause the skill to activate during ordinary conversation when the user did not intend to run an audit workflow. Because this skill is designed to scan installed skills and generate reports, accidental invocation could cause unintended file reads and side effects in the workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill explicitly writes a report file to the workspace but does not warn the user in its visible description about this side effect. Unannounced file creation can surprise users, overwrite expectations about workspace cleanliness, and expose potentially sensitive inventory or audit details in a predictable location.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.