Security audit

Self-Heal Watchdog

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly transparent about its watchdog purpose, but it installs persistent automation that can change OpenClaw settings and includes unsafe failover scripting that warrants review before installation.

Install only if you deliberately want a background watchdog that can restart OpenClaw and change the configured model automatically. Before unattended use, review or patch the failover script to remove eval and unsafe string interpolation, test with DRY_RUN=1, confirm backups exist, and know how to unload the launchd agent if the watchdog behaves unexpectedly.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises shell execution and file-writing behavior but does not declare any permissions, which creates a capability transparency gap. In an agent environment, hidden operational powers like modifying config files, installing launchd jobs, and restarting services can cause unauthorized persistence or destructive changes if the skill is invoked unexpectedly.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README instructs users to install a watchdog that registers a persistent launchd service, creates backups, performs automatic config rollback, and can switch models automatically, but it does not clearly warn that these actions modify local configuration and persist across sessions. In an agent skill context, undisclosed persistence and autonomous config changes increase the chance that a user enables behavior they do not fully understand, which can lead to loss of control, unexpected restarts, or silent model changes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The uninstall section includes deletion commands that permanently remove watchdog files and the launch agent, but the README does not visibly warn that these removals are destructive. In practice this can cause accidental data loss of logs, state, and backups if a user copies commands without understanding the consequences.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list includes broad terms like watchdog, monitoring, recovery, and health check, which are common in normal troubleshooting conversations and may cause the skill to activate when the user did not intend self-healing actions. Because this skill can run shell scripts, restart a gateway, modify configuration, and set up scheduled execution, overbroad triggering increases the chance of unintended system changes or persistence.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: README.md:107