Back to skill

Security audit

Manus AI Skill for OpenClaw

Security checks across malware telemetry and agentic risk

Overview

The skill is a real Manus API integration, but it delegates broad autonomous actions to an external service with connected-account access, file upload, webhook exposure, and limited guardrails.

Install only if you trust Manus and the publisher with the prompts, uploaded files, and connected accounts involved. Use least-privilege or test accounts, avoid uploading secrets or regulated data, require explicit human confirmation before bookings, posts, calendar changes, or account mutations, and avoid exposing the webhook server publicly unless you add network restrictions and webhook authentication.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares only an environment variable requirement, but the documented behavior clearly includes network access to external APIs and webhook listener functionality. Undeclared capabilities reduce informed consent and can cause hosts or users to grant the skill more effective power than its manifest communicates.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The top-level description presents a broad autonomous agent, but the documented operations also include project creation, file uploads, webhook management, and running a local HTTP listener. This mismatch can mislead users about the actual attack surface and operational side effects, especially where authenticated accounts and inbound network exposure are involved.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README advertises connectors to services like Gmail, Notion, Google Calendar, and Slack, but does not clearly warn users that prompts, account data, and possibly sensitive content may be transmitted to a third-party Manus service. In an autonomous agent skill, this omission is security-relevant because users may invoke the integration without understanding the privacy and data-sharing implications.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README provides examples that can modify external accounts or systems, such as creating Notion pages, scheduling calendar events, and posting to Slack, without warning users that these actions may have real side effects. In the context of an autonomous agent skill, this increases the risk of unintended account changes, misuse of connected integrations, or accidental actions on production workspaces.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The README instructs users to upload local files for task context but does not explicitly warn that file contents may be transmitted to the Manus service for processing. This is dangerous because users may upload confidential local documents, source code, credentials, or regulated data without understanding that the material leaves the local environment.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill encourages actions against Gmail, Notion, Google Calendar, and Slack, including reading private data and posting messages, without an upfront warning about privacy, account impact, or external side effects. In this context, prompts could cause unintended disclosure, modification, or outbound communication using the user's authenticated sessions.

Missing User Warnings

High
Confidence
97% confidence
Finding
The notes explicitly state full internet access, software installation capability, and persistence of authenticated sessions, but provide no corresponding safety warning or usage guardrails. In an autonomous agent skill, this materially increases the risk of data exfiltration, account misuse, and execution of unsafe tasks if prompts are ambiguous or malicious.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The package description advertises very broad capabilities such as autonomous research, development, automation, and media generation without meaningful scope limits. In agent ecosystems that use metadata for routing or invocation, this can cause the skill to be selected for tasks well beyond its safe or intended boundary, increasing the chance of over-privileged execution or unsafe delegation.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
User-supplied prompts are sent directly to an external third-party API, but the script provides no explicit warning or consent checkpoint about network disclosure. In an agent-skill context, prompts may contain secrets, internal data, or proprietary instructions, so silent transmission increases the risk of unintended data leakage.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The webhook handler logs task titles and error strings received from incoming network data directly to stdout. Those fields may contain sensitive user content, internal identifiers, or attacker-supplied text, causing inadvertent data exposure in logs and possible log injection or terminal control-sequence abuse in some environments.

External Transmission

Medium
Category
Data Exfiltration
Content
if title:
        data["title"] = title
    
    response = requests.post(url, json=data, headers=headers)
    
    if response.status_code != 200:
        print(f"❌ Error creating task: {response.text}")
Confidence
90% confidence
Finding
requests.post(url, json=

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.