ClawHub
Back to skill

Security audit

Yunitalk Beta

Security checks across malware telemetry and agentic risk

Overview

This integration is mostly coherent, but it handles live OpenClaw and robot credentials in ways that can expose usable access details in terminal output and logs.

Install only if you trust the publisher and will run setup from a private terminal. Treat the generated QR/base64 command and any signed request URL as credentials, avoid sharing logs or screenshots, and prefer using this only in environments where OpenClaw and Talk Robots credentials are intentionally connected.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill advertises and instructs use of environment variables, shell execution, and network access but does not declare permissions or capability boundaries. This weakens reviewability and can cause operators to authorize a skill without understanding that it can access secrets and send data externally.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The documented behavior goes well beyond a simple chat integration: it involves reading local OpenClaw configuration, discovering LAN/public network information, generating a base64 initialization payload containing sensitive connection details, and providing signed message/file sending to a robot endpoint. In this context, the mismatch is dangerous because operators may grant trust based on the narrow description while the skill can expose tokens, topology, and enable outbound data transfer including file upload.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
This initializer reads the local OpenClaw config, extracts the gateway token, derives LAN/public URLs, and prints a base64-encoded '/openclaw --init' command plus a QR code containing those credentials. Although intended for setup convenience, this exposes sensitive connection details to terminal logs, screenshots, shell history capture, and anyone who can view the console, materially increasing the risk of unauthorized remote access to the OpenClaw gateway.

Context-Inappropriate Capability

Medium
Confidence
82% confidence
Finding
The script contacts multiple third-party IP discovery services to determine the host's public IP, disclosing metadata that the machine is running this initializer and creating an unexpected outbound network dependency. In the context of a chat-integration bootstrap tool, this is broader-than-necessary behavior and can leak environment/network information or help construct an Internet-reachable endpoint automatically without clear user consent.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The documentation explicitly recommends a dry-run mode that prints the fully signed request URL, and that URL contains live authentication material such as robot_id, noncestr, timestamp, msg_id, and especially the HMAC sign value. In many environments, dry-run output is captured by terminal history, CI logs, chat transcripts, or support tickets, which can expose valid request metadata and enable replay within the server's acceptance window or leak sensitive operational details.

Missing User Warnings

High
Confidence
98% confidence
Finding
The script prints the full signed request URL, signing_text, nonce, message ID, and HMAC signature to stdout. In many real environments stdout is captured by CI logs, shell history wrappers, process supervisors, or shared terminals, which can expose replayable authenticated request material and sensitive operational metadata to unintended parties.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.