ClawHub
Back to skill

Security audit

Openclaw Workspace Initializer

Security checks across malware telemetry and agentic risk

Overview

This skill initializes a workspace with standard folders and persistent guidance files, and its file-writing behavior is disclosed and aligned with that purpose.

Before installing, expect the skill to create standard workspace folders, add WORKSPACE.md rules, possibly update AGENTS.md startup/config guidance, and append a memory log. Review the Chinese-language workspace rules if you want different directory conventions or language defaults.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The workspace instructions are written as mandatory operational rules in Chinese and do not offer any language or locale choice. Under the policy, forcing a specific language without explicit user opt-in is a natural-language policy violation unless the constraint is documented as justified or region-specific, which is not present here.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.