ClawHub
Back to skill

Security audit

ii-IRC

Security checks across malware telemetry and agentic risk

Overview

The skill is transparent about its IRC bot behavior, but it lets IRC mentions automatically feed raw chat text into the local OpenClaw agent without sender controls.

Install only if the watched IRC channels are trusted or moderated. Before broad use, add sender/channel allowlists, event rate limits, message truncation or sanitization, and keep the agent’s permissions limited; disable the watcher or systemd services when the bot should not be reachable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill declares shell-install and setup behavior but does not explicitly declare permissions for shell-capable actions. This weakens policy enforcement and makes it easier for an agent or user to underestimate the operational risk of executing commands that install software, create services, and manage persistent processes.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The generated watcher forwards the full content of any IRC message mentioning the bot to `openclaw system event --text`, creating an automatic cross-tool data flow from a public or semi-public chat into another system. This can leak sensitive channel content, allow untrusted users to inject prompt/event content into downstream automation, and the script provides no consent, filtering, or warning to the operator about that behavior.

Ssd 3

Medium
Confidence
95% confidence
Finding
The design forwards IRC messages verbatim into `openclaw system event --text`, creating a direct untrusted-input channel from a public IRC network into the agent’s event stream. This can leak sensitive channel content into the agent context and enable prompt-injection or instruction-manipulation attacks originating from any user who can mention the bot.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.