ClawHub
Back to skill

Security audit

Openclaw Plugin

Security checks across malware telemetry and agentic risk

Overview

hopeIDS fits its security-scanning purpose, but it overstates some protections and under-discloses where message content may be sent for analysis.

Review this before installing in a sensitive agent environment. Disable external classifier paths unless you are comfortable sending flagged prompt excerpts to the configured model or agent, set trustOwners to false for higher-risk deployments, do not rely on Telegram alert delivery without testing it, and use a pinned and reviewed hopeid dependency on a patched OpenClaw host.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The plugin documentation and stated security invariants claim Telegram alerts for blocked messages, but the implementation only logs alert text locally and never sends a Telegram message. In an IDS/quarantine workflow this creates a false sense of monitoring, so high-risk blocked events may go unseen and unreviewed, delaying response and weakening incident handling.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The code advertises 'Block = full abort' but in the auto-scan hook it only returns an object indicating blockage and does not invoke the provided abort callback. If the hosting framework does not treat that return value as authoritative, malicious prompts may still proceed to downstream processing despite being classified as blocked.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The `/trust <senderId>` command permanently or semi-permanently whitelists a sender for future messages, but the skill does not clearly warn that this reduces or bypasses future scanning/protection. In a security product, this can cause operators to disable protections for a sender without understanding the risk, allowing a compromised or spoofed account to evade detection later.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The plugin forwards user message content to the llm-task classifier, which may route data to an external model/provider, without any explicit disclosure or consent at the call site. This can expose sensitive prompts, secrets, or personal data to third-party services and violates the module's own privacy-oriented framing around metadata-only handling.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The classifier-agent path sends up to 2000 characters of the original message to another agent for analysis without explicit user-facing warning or data-handling guarantees. Even if described as sandboxed, this still broadens access to raw content and may leak secrets or regulated data into another component's logs, memory, or model context.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The manifest advertises Telegram alerts for blocked messages but does not clearly disclose that alert payloads may contain message-derived or sensitive security event data sent to an external Telegram destination. In a security-scanning plugin, blocked content is especially likely to include suspicious prompts, secrets, or user-provided material, so silent exfiltration to a third-party channel creates a real privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The manifest enables LLM-based semantic analysis through a configurable endpoint and llm-task/provider settings without clearly warning that user messages may be forwarded to an external model service. Because this plugin analyzes message content for security decisions, forwarded data could include sensitive prompts, secrets, or incident-related material, creating unintended data exposure and compliance risk.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"extensions": ["."]
  },
  "dependencies": {
    "hopeid": "^0.1.0"
  },
  "peerDependencies": {
    "openclaw": ">=2025.0.0"
Confidence
95% confidence
Finding
"hopeid": "^0.1.0"

Known Vulnerable Dependency: openclaw==2025.0.0 — 10 advisory(ies): CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-32064 (OpenClaw's andbox browser noVNC observer lacked VNC authentication); CVE-2026-32006 (OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallbac) +7 more

High
Category
Supply Chain
Confidence
88% confidence
Finding
openclaw==2025.0.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.