ClawHub
Back to skill

Security audit

Modular Skill Groups

Security checks for vulnerabilities and agentic risk

Overview

This skill is a transparent local skill-group switcher, with the main caveat that its choice persists and can affect future agent behavior.

Install this if you want persistent skill-group switching. Review the predefined groups, and check ~/.openclaw/active_skill_group if the agent appears to be using an unexpected skill set.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill advertises activation on very broad phrases such as 'what skills do I have', 'load skills', and 'too many skills', which are common in normal conversation and can cause accidental invocation outside the user's intent. In a skill that changes active skill groups and context composition, unintended triggering can alter agent behavior, create context confusion, and lead to inappropriate tool or skill activation.

Static analysis

No suspicious patterns detected.