ClawHub
Back to skill

Security audit

clawsec-suite

Security checks across malware telemetry and agentic risk

Overview

This security-suite skill uses disclosed network checks, optional persistent automation, and guarded install flows that match its purpose, but users should review the broad triggers and opt-in automation before enabling them.

Install only if you want a security suite that can persistently monitor OpenClaw skills. Review the hook and cron setup before running those scripts, avoid enabling unsigned feed mode except temporarily, and use suite-specific commands when asking to update or verify skills.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares no permissions, yet the documentation clearly instructs use of environment variables, shell commands, network downloads, filesystem modification, hook installation, and cron/job setup. This mismatch is security-relevant because it can cause the harness or reviewer to underestimate the skill’s effective capabilities and trust boundary. In context, the suite is explicitly a security-management installer, so the behavior is likely intentional rather than malicious, but the undeclared capability surface is still a real issue.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The code documents that security policy violations must always propagate, but both fetchText and loadRemoteFeed suppress SecurityPolicyError by converting it to null. That can hide policy enforcement failures, making callers treat blocked or invalid remote sources as ordinary fetch misses and potentially continue with fallback behavior without visibility or alerting.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list includes very broad, generic phrases such as 'security advisories', 'update skills', and 'verify skills' that are likely to match ordinary user requests outside the narrow intended scope. In an agent environment, this can cause unintended invocation of a persistent, security-sensitive skill that is capable of recommending installs, enabling hooks/cron jobs, and influencing skill-management workflows.

Session Persistence

Medium
Category
Rogue Agent
Content
echo "Checksums manifest signature and archive hash verified."

# 3) Install verified archive
mkdir -p "$INSTALL_ROOT"
rm -rf "$DEST"
unzip -q "$TEMP_DIR/$ZIP_NAME" -d "$INSTALL_ROOT"
Confidence
91% confidence
Finding
mkdir -p "$INSTALL_ROOT" rm -rf "$DEST" unzip -q "$TEMP_DIR/$ZIP_NAME" -d "$INSTALL_ROOT" chmod 600 "$DEST/skill.json" find "$DEST" -type f ! -name "skill.json" -exec chmod 644 {} \; echo "Installed

Self-Modification

High
Category
Rogue Agent
Content
"install security skills",
      "verify skills",
      "check skill integrity",
      "update skills"
    ]
  }
}
Confidence
84% confidence
Finding
update skill

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
advisories/feed.json:23963