Security audit

Skill-cleaner

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate skill-maintenance tool, but it can disable or forcibly uninstall installed skills with weak built-in safeguards.

Install only if you want a local tool that can inspect and manage your OpenClaw skills. Use report-only first, verify every listed target, prefer disable over uninstall, and do not run the clean action unless you explicitly chose the exact skills to change.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares no permissions in its manifest, yet its entrypoint and actions indicate capabilities to read files, access environment variables, and invoke shell commands. For a skill that scans all installed skills and can disable or uninstall them, this missing permission declaration removes an important transparency and policy-control layer, making destructive or privacy-impacting behavior harder to review and constrain.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill goes beyond passive health inspection and can disable or forcibly uninstall other skills, including via a direct command-line mode. In an agent environment, that is a destructive management capability that can be triggered on potentially incomplete or incorrect diagnostics, causing denial of service against other skills.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrases are broad operational requests such as checking skill status or cleaning unusable skills, without clear scope limits or safeguards. Because this skill can inspect the workspace and perform disable/uninstall actions, loose invocation criteria increase the chance of accidental activation and unintended destructive changes, especially in ambiguous conversations.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The description advertises disabling or uninstalling skills based on missing configuration, but it does not warn users that these actions may remove functionality, alter workspace state, or affect user configuration. In context, this is more dangerous because the skill is positioned as an automated cleaner, which can normalize destructive maintenance actions without adequately communicating consequences.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The uninstall path uses a forced removal command with no confirmation, preview, or safeguard. In a skill-management context, this can irreversibly remove working components due to misdiagnosis, operator error, or malicious invocation of the cleaner, leading to service disruption.

Static analysis

No suspicious patterns detected.