Security audit

clawbba-api

Security checks across malware telemetry and agentic risk

Overview

This skill appears to connect OpenClaw to ClawBBA, but its setup relies on unverified remote code and makes broad local OpenClaw changes that are not fully reviewable in the submitted artifact.

Review this carefully before installing. Use it only if you are comfortable giving the package permission to change OpenClaw configuration, persist your ClawBBA API key locally, patch OpenClaw runtime files, and restart the gateway. Prefer a download-and-review install flow with checksums or signatures, avoid pasting production keys into shared logs or screenshots, and assume prompts or uploaded reference media may be sent to remote providers for generation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The installer does substantially more than install an API-backed skill: it deletes and replaces the skill directory, writes OpenClaw configuration, applies runtime patches, verifies runtime state, and restarts the gateway. For a skill described as simple API access for messaging/model integration, these broad host modifications materially expand trust and attack surface, especially because the downloaded package is then allowed to run multiple local scripts with the user's privileges.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The script invokes a version-alignment step that can alter the host OpenClaw installation or force compatibility changes before the skill is installed. That is an administrative action unrelated to merely configuring access to a remote API, and it creates a pathway for unexpected system-wide changes from an untrusted downloaded package.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation recommends executing a shell script fetched directly from a remote server via a pipe to bash, without integrity verification or a strong warning. If the server, CDN, DNS, TLS termination, or publishing pipeline is compromised, arbitrary code will run immediately on the user's machine.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The setup command uses a local shell script with automatic confirmation, while the skill indicates that setup writes configuration, synchronizes models, and injects patches. Running it with --yes suppresses informed consent and increases the chance that users will apply filesystem and runtime changes they do not fully understand.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document instructs agents to directly call external media-generation tools based on user input, but it does not disclose that prompts and related parameters are transmitted to third-party providers such as OpenRouter-backed model endpoints. This creates a real privacy and consent risk because users or downstream agents may treat the action as local processing and send sensitive text or media to remote services without explicit notice.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The reference-image workflow explicitly mentions local inbound file paths, which can mislead implementers into thinking the files stay on-device, while the workflow actually feeds those files into remote image/video generation tools. If sensitive local media is uploaded without a clear warning, users may unknowingly expose private images or internal documents to external providers.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The deployment instructions include an API key assignment example using a live-key format (`cbb_sk_live_…`) without any surrounding warning about secret handling, storage, rotation, or avoiding shell history leakage. Even though the value is partially redacted, this normalizes unsafe credential practices and may lead operators to paste real production secrets into insecure environments, logs, or screenshots.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script advertises installation via 'curl | bash', which executes remote content immediately without giving the user an opportunity to inspect it or validate provenance. If the hosting site, DNS, TLS termination, or distribution path is compromised, arbitrary code runs instantly on the target machine.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The installer unconditionally removes the existing target skill directory and recreates it, which can destroy local modifications or prior trusted content without confirmation. In a supply-chain compromise scenario, this also ensures replacement of an existing installation with attacker-controlled files.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/verify-openclaw-runtime.mjs:26