ClawHub
Back to skill

Security audit

clawsec-feed

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed security advisory feed skill with normal feed download, install, and local state guidance, plus manageable scope and trigger caveats.

Install this if you want an agent-security advisory feed. Prefer the signed verification workflow over the one-line latest-release download, and do not assume every advisory applies only to OpenClaw.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The feed metadata says it is an OpenClaw-related advisory feed, but the content includes unrelated products such as hermes-agent, picoclaw, and nanoclaw. Consumers that trust this scope claim may make incorrect security decisions, trigger false remediation actions, or poison automated triage pipelines that assume all entries apply to OpenClaw ecosystems.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The trigger list includes broad phrases like 'security advisories', 'security alerts', and 'security news' that could match ordinary user conversation and cause the skill to activate unexpectedly. In a security-themed skill, accidental invocation is more concerning because it may prompt network fetches or inject unreviewed advisory content into workflows when the user did not explicitly request this package.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
advisories/feed.json:21364