ClawHub
Back to skill

Security audit

Openclaw Skill Money Idea Generator

Security checks across malware telemetry and agentic risk

Overview

This skill matches its stated money-idea-generation purpose, with some clear privacy and dependency caveats but no artifact-backed malicious behavior.

Install only if you are comfortable with public web/API lookups, optional use of a low-privilege GitHub token, local storage of generated business and revenue notes, and the possibility that a locally installed bird command may be run for Twitter trend search.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The example trigger phrases are broad, natural-language requests such as asking for money-making ideas or opportunities. In an assistant/skill system, such generic phrases can unintentionally activate the skill during ordinary conversation, causing unauthorized invocation, unexpected external data access, or misleading responses outside the user's intended context. The skill context increases risk because it is framed as a general-purpose idea generator with multiple common phrases rather than narrowly scoped commands.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger phrases are broad, natural-language requests such as asking for money-making ideas or opportunities, which can easily overlap with ordinary conversation. That increases the chance the skill auto-invokes unintentionally, potentially causing unexpected network access, scraping, file writes, or other side effects in contexts where the user did not explicitly intend to run this skill.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The class creates a persistent directory in the user's home path and later writes idea, execution, and revenue records to disk without any visible notice, consent flow, or retention controls. Because these records can contain business plans, logs, notes, and earnings data, silent persistence increases privacy risk on shared systems and can expose sensitive commercial information to other local users or backups.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal