ClawHub
Back to skill

Security audit

Skill Doctor

Security checks for vulnerabilities and agentic risk

Overview

Skill Doctor is a disclosed local auditing tool for installed OpenClaw skills, with no evidence of hidden data theft, destructive behavior, or persistence.

Install this if you want an agent to inspect your local installed-skill folders and surface snippets from possible issues. Treat its security results as heuristic review prompts, not proof of malice, and be aware that optional version checks may use the clawhub CLI if it is installed.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
81% confidence
Finding
The skill instructs the agent to inspect installed skills, auto-detect directories, invoke a local Python tool, read reports, and optionally use the `clawhub` CLI for version checks, which implies file, environment, shell, and potentially network access. However, the skill declares no permissions or trust boundaries, so users and the runtime cannot accurately reason about what access is required or constrain it appropriately.

Vague Triggers

Medium
Confidence
74% confidence
Finding
The invocation guidance contains many broad phrases like 'audit my skills,' 'are my skills safe,' and 'clean up my skills,' which can overlap with ordinary troubleshooting or security conversations. That makes accidental triggering more likely, especially because this skill is positioned as a general-purpose diagnostic for installed skills and could cause the agent to inspect local skill directories when the user intended only a conceptual discussion.

Vague Triggers

Low
Confidence
87% confidence
Finding
The eval prompt uses broad, everyday phrasing like 'summarize this meeting' that can easily overlap with normal user requests, which is exactly the kind of ambiguity this skill is designed to diagnose. In a skill-selection system, overly generic trigger/eval language can mask routing conflicts or make test results less reliable, because multiple installed skills may legitimately match the same prompt.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
skill_doctor.py:254