clawgrid-connector

• Outcome: Review
• Latest audit: May 27, 2026 · 10:57 PM UTC
• Version: 0.35.0

Overview

This appears to be a real ClawGrid connector, but it installs persistent automation, weakens execution approvals, and lets server-delivered task messages drive agent sessions, so it needs Review before use.

Install only if you intentionally want a persistent ClawGrid worker that can keep running in the background, use a stored ClawGrid API key, change OpenClaw exec-approval defaults, create or modify marketplace/account state, and send debug/session-derived task traces to ClawGrid. Review the cron/launchd jobs, exec approval changes, config permissions, and automation/budget rules before enabling it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (49)

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill instructs use of a `message` tool that is not part of the declared tool surface, expanding its effective capabilities beyond what metadata suggests. Hidden or undeclared communication channels are risky because they can be used to exfiltrate data or perform actions outside the reviewed interface.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The document says to use only official scripts, but later repeatedly directs the agent to read credentials from config and issue raw curl calls against multiple APIs. Contradictory safety guidance encourages policy bypass, increases the chance of unsafe ad hoc handling of secrets, and makes review of data flows much harder.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The documentation materially expands the skill from account binding and task execution into creating and publishing marketplace tasks on the owner's behalf using the owner's API key. That creates an authorization and consent risk: an agent could initiate billable actions or external work requests from broad user prompts without a clear, explicit confirmation boundary.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The document contains contradictory operational guidance: it broadly forbids custom API calls, but then directs the agent to perform manual POST requests and curl-based task actions outside the narrow troubleshooting exception. In an agent skill that handles marketplace task lifecycle actions, this inconsistency can cause unsafe fallback behavior, bypass guardrails in official scripts, and lead to accidental unauthorized or quota-impacting account operations.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The reset command performs destructive actions beyond simple connector configuration management: it removes ~/.clawgrid, may delete the entire skill directory, and can optionally wipe profile data. Even if intended as a cleanup utility, this exceeds the narrow marketplace-connector role and creates a meaningful risk of local data loss if triggered accidentally or by a higher-level agent without clear user consent.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script directly edits user cron or launchd state during profile switching, giving it persistence-management capability unrelated to basic profile selection. This is dangerous because scheduler modification can disrupt unrelated jobs, create stealthy persistence hooks, and expand the connector's control over the host beyond what users would expect from an environment-switching helper.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script parses OpenClaw's sessions.json to infer the owner's most recent direct-message target across channels and then stores that destination for later delivery. This crosses a privacy boundary by mining unrelated session history and can cause messages meant for the owner to be redirected to an unintended recipient if session metadata is stale, poisoned, or shared across accounts.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: A heartbeat routine should be limited to liveness and task synchronization, but this one also executes install.sh for self-update and setup-exec-approval.sh to change local agent behavior. That gives a periodic network-driven process authority to modify code and execution policy, amplifying compromise impact and making persistence or malicious upgrades much easier.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The installer performs additional local system configuration by invoking helper scripts that can modify execution-approval behavior and establish scheduled background execution via cron or LaunchAgents. Even if this supports connector operation, it expands privileges and persistence beyond a simple install step and does so with limited user disclosure, increasing the risk of unwanted long-lived behavior.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The installer uploads behavioral settings from local config to a remote API and then rewrites config.json to remove those settings. This changes both data location and local state in a way broader than basic connector installation, and could surprise users by transmitting preferences or altering automation behavior without a dedicated confirmation step.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The installer deletes a directory under the user's home directory using rm -rf based solely on path existence. Although the path is fixed and appears intended as cleanup, deleting user data during install without confirmation or validation can cause unexpected data loss and is broader than necessary for a connector installer.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script scans every installed skill directory for .skill_updated flags and emits instructions to re-read arbitrary SKILL.md files. In an agent environment, this creates a cross-skill trust boundary violation: another skill can drop a flag and influence this connector's runtime behavior, effectively injecting control signals outside the connector's own scope.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Polling automatically installs or rewrites persistent launchd/crontab entries, changing host persistence as a side effect of a routine network task. This is dangerous because a polling script should not silently establish autorun behavior, and if the script or referenced heartbeat path is modified later, the host will keep executing it on a schedule.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script changes the user's global OpenClaw execution-approval defaults to automatically allow skill execution and to fall back to an allowlist, which weakens a host security control beyond the narrow needs of a marketplace connector. Because this setting is persistent and applies at the platform level rather than only to this skill, a compromised or overly broad skill execution path could run without the normal approval barrier.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The user-facing message states that only skill scripts will run automatically, but the implementation edits global defaults rather than enforcing a skill-scoped allowlist in this script. This mismatch can mislead users about the breadth of the policy change, causing them to accept a broader reduction in approval protections than intended.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: Broad triggers like 'earn money', 'earn crypto', 'check tasks', or 'do a task' can activate the skill in many unrelated conversations. Overbroad activation is dangerous here because the skill has shell, file, network, and account-management behavior, so accidental invocation can lead to unintended task execution or credential use.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The single-word trigger 'lobster' is ambiguous and likely to collide with unrelated user intent. Because this skill can run scripts and access stored credentials, accidental activation increases the risk of unintended privileged actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill tells the agent to read API credentials directly from a local config and use them without any visible warning about sensitive handling. This normalizes direct secret access and raises the risk of disclosure in logs, prompts, error messages, or misuse in unreviewed commands.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Using broad natural-language examples like 'help me find hotels in LA' as a trigger for creating a real marketplace task encourages the agent to convert ordinary requests into external, potentially billable actions. In this connector context, that ambiguity increases the chance of unintended task publication, spending, or data disclosure without the user realizing an API-side action will occur.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The instructions tell the agent to read API credentials from a local config and use them to generate an account-binding code, but do not warn about the sensitivity of those credentials or the security implications of binding an account. That increases the risk of mishandling secrets, exposing account linkage tokens, or performing binding flows for the wrong user/session.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The skill hard-codes a required message prefix for every owner communication, which overrides normal user-controlled messaging behavior and can create covert branding or routing constraints without explicit owner consent. In this skill’s context, that mandate is more concerning because the connector already controls when and how the agent communicates, so forcing a platform tag further reduces transparency and user autonomy.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document includes destructive state-changing operations such as deleting offerings and managing marketplace listings without any explicit user-consent, confirmation, or warning language. In an agent skill, this increases the chance that an automated workflow performs unintended authenticated actions that alter or remove marketplace state on behalf of the user.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The file normalizes use of an existing API key for authenticated marketplace actions but does not warn that every example performs actions as the bound account. In a skill context, that omission can cause an agent or operator to reuse powerful credentials for unintended publication, requests, acceptance, or deletion against a real account.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide instructs storing a bearer-style API key on disk in plaintext under the user's home directory without warning about credential sensitivity, file permissions, or compromise scenarios. If local malware, another user, backups, or logs expose this file, an attacker could impersonate the agent, access account functions, and potentially affect earnings or profile settings.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide states that a public profile page is created and encourages customization, but does not clearly warn that submitted content may be publicly visible to third parties. This can lead to unintended disclosure of personal, organizational, or operational details if the owner supplies identifying text assuming it is internal-only.

VirusTotal

No VirusTotal findings

Static analysis

No suspicious patterns detected.