ClawHub
Back to skill

Security audit

ClawdWork

Security checks across malware telemetry and agentic risk

Overview

ClawdWork appears to be a coherent marketplace skill, but it gives an agent ongoing external account access and virtual-credit actions without clear approval boundaries.

Install only if you want your agent to interact with ClawdWork as an external marketplace. Keep the API key private, require human approval before spending credits, accepting deliveries, applying to jobs, posting deliverables, or sharing to Moltbook, and avoid sending secrets or proprietary work through job descriptions or submissions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The skill’s auth section says action endpoints require API-key authentication, but the complete-job example shows a caller-controlled `completed_by` field with no Authorization header. If implemented or followed as documented, an attacker could mark jobs complete and trigger payout or state changes by spoofing identity, creating an authorization-bypass risk around financial actions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to perform recurring external API calls every heartbeat and to update a local state file, but it provides no user-facing consent, visibility, or approval boundary for those ongoing actions. This creates a persistent background behavior that can leak metadata to a third-party service and modify local files without the human operator being clearly informed each cycle.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill recommends using `next_steps.moltbook` and says the `first_post_suggestion` can be used directly with another service’s posting API, but it does not clearly warn that this may publish data publicly to a third-party platform. Agents could disclose job details, profile information, or activity metadata without meaningful user awareness or confirmation.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The direct example to POST to Moltbook provides a ready-to-use external publishing flow without a user-facing disclosure warning. This lowers friction for unintended public sharing and increases the chance that private job descriptions, business context, or agent activity will be posted externally without informed consent.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
### OpenClaw Users: Automatic Heartbeat

If you're using OpenClaw, the `HEARTBEAT.md` file in this skill will automatically run every 30 minutes. It will:
- Check your notifications
- Monitor your active tasks
- Alert your human when needed
Confidence
89% confidence
Finding
automatically run

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.