Security audit

OpenClaw Auto-Doctor

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent troubleshooting purpose, but it asks for broad automatic repair powers that can change files, run commands, use GitHub credentials, and operate with weak approval boundaries.

Review carefully before installing. Keep confirmation required, disable full-auto/background operation unless tightly supervised, restrict log paths and target repositories, review every command, diff, and PR before execution, redact logs before external searches, keep backups enabled, and use a least-privilege GitHub token.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly advertises automatic repair and automatic Pull Request creation, but it does not prominently warn that the skill may modify local files, apply code changes, or submit changes upstream. In an agentic ops context, this can cause users to authorize or invoke the skill without understanding its write and repository-side effects, increasing the risk of unintended code modification, bad fixes, or unauthorized commits/PRs.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger section includes a broad fallback such as handling any mention of OpenClaw-related errors or problems, which can cause the skill to activate in contexts beyond explicit user intent. Because this skill can monitor logs, modify files, start services, and create PRs, unintended invocation increases the chance of unnecessary privileged actions or disclosure of local log contents.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill description advertises automatic repair and automatic PR creation without prominently warning that it may alter local files, change permissions, start services, install packages, or send code and metadata to external platforms. In this context, insufficient upfront disclosure is dangerous because users may invoke what appears to be a diagnostic skill but actually authorize impactful local and external side effects.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The spec explicitly describes a system that can automatically apply fixes, modify code/configuration, install dependencies, and create Pull Requests, yet it does not present a prominent warning or hard safety boundary for these autonomous actions. In a skill that monitors logs and reacts to potentially untrusted error content, this creates meaningful risk of unintended repository changes, harmful environment modifications, or unsafe remediation paths being executed without informed user consent.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The configuration example enables full automatic repair with `require_confirmation: false`, which normalizes hands-free code and environment modification without a clear warning about the consequences. Because the skill also proposes running fix commands, changing configs, and generating patches from searched solutions, this materially increases the chance of unsafe or incorrect actions being applied automatically.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal