ClawHub
Back to skill

Security audit

nearai-verify

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it checks NEAR AI endpoint privacy using disclosed local checks, network attestation, and optional package installation.

Install this if you want NEAR AI endpoint privacy checks and are comfortable with it reading OpenClaw config/log metadata, contacting NEAR/Intel/NVIDIA attestation services, and optionally creating a local venv after confirmation. Treat CLAIMED results as configuration evidence only; rely on ATTESTED only when the cryptographic checks actually pass.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print("  venv creation failed - is python3-venv installed?")
        return 1
    print(f"Installing {' '.join(EXTRAS)}")
    r = subprocess.run([str(VENV / "bin" / "pip"), "install", "-q", *EXTRAS])
    if r.returncode:
        print("  install failed - see pip output above")
        return 1
Confidence
84% confidence
Finding
r = subprocess.run([str(VENV / "bin" / "pip"), "install", "-q", *EXTRAS])

Tainted flow: 'VENV' from os.environ.get (line 35, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
print("  venv creation failed - is python3-venv installed?")
        return 1
    print(f"Installing {' '.join(EXTRAS)}")
    r = subprocess.run([str(VENV / "bin" / "pip"), "install", "-q", *EXTRAS])
    if r.returncode:
        print("  install failed - see pip output above")
        return 1
Confidence
91% confidence
Finding
r = subprocess.run([str(VENV / "bin" / "pip"), "install", "-q", *EXTRAS])

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs execution of local Python scripts, network access to Intel and NVIDIA attestation services, possible package installation, and creation of a local virtual environment, yet the manifest does not declare corresponding permissions. This mismatch can cause users or orchestrators to invoke a skill with broader capabilities than its metadata signals, undermining consent, review, and sandbox policy enforcement.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The script explicitly states it provides only 'CLAIMED' assurance by reading local config, a public endpoint catalog, and local logs, yet the skill metadata promises cryptographic attestation, Intel TDX quote verification, and proof of whether the endpoint is a real TEE. In a security-verification skill triggered before handling sensitive data, this mismatch is dangerous because users may rely on a non-cryptographic check as if it were proof and disclose secrets to an unverified or non-enclave endpoint.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrase "prove it" is broad and likely to appear in ordinary conversation unrelated to endpoint attestation. That can activate a skill that performs local inspection, shell execution, and external network requests unexpectedly, creating privacy, UX, and least-surprise violations even if the skill's purpose is legitimate.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation condition "before handling sensitive data" is underspecified and can cause the skill to auto-run in many contexts without a clear user request. Because this skill may inspect configuration/logs, reach external services, and offer package installation, ambiguous preemptive activation increases the chance of unintended data exposure or capability use.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
test_attest.py:17

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
attest.py:201