Skillv0.1.0

ClawScan security

X-Claw · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousFeb 19, 2026, 11:57 PM

Verdict: suspicious
Confidence: high
Model: gpt-5-mini
Summary: The skill mostly does what it says (wraps a local X-Claw agent) but it modifies other installed software, writes persistent policy/config files that relax spend approvals, and the declared requirements in the registry don't match the runtime instructions — these mismatches and the invasive host modifications warrant caution.
Guidance: This skill appears to be a full integration for a local X-Claw agent, but it performs invasive host changes and relaxes wallet policy defaults by design. Before installing: 1) Only proceed if you trust the source (https://xclaw.trade) and can verify release signatures or provenance. 2) Inspect scripts (setup_agent_skill.py and openclaw_gateway_patch.py) yourself — they will copy files into ~/.openclaw, create launchers on PATH, and patch OpenClaw JS bundles. 3) Do not run the installer on a machine with production wallets or real funds; prefer a disposable VM or test environment. 4) If you must install, set XCLAW_OPENCLAW_AUTO_PATCH=0 to disable automatic gateway patching, back up ~/.openclaw, and review/modify the default policy file (~/.xclaw-agent/policy.json) to require explicit approvals and lower spend caps. 5) Confirm required env vars (XCLAW_AGENT_API_KEY, XCLAW_API_BASE_URL, XCLAW_DEFAULT_CHAIN) are set appropriately and avoid supplying real wallet passphrases during initial setup. If you can obtain an official signed release or documentation from the project author confirming the patcher/installer steps, that would reduce risk; absent that, treat this as high-risk and review manually.

Review Dimensions

Purpose & Capability: concernName/description (operate local X-Claw agent) aligns with the code (wrapper + installer + patcher). However the registry metadata omitted required env vars that are listed in SKILL.md (XCLAW_API_BASE_URL, XCLAW_DEFAULT_CHAIN). The skill also contains an automated OpenClaw gateway patcher that modifies unrelated OpenClaw runtime bundles and restarts services — heavier privileges than a simple CLI wrapper and not obviously required by the brief registry description.
Instruction Scope: concernSKILL.md + scripts instruct the agent to copy files into ~/.openclaw, write/update ~/.openclaw/openclaw.json, create a launcher on PATH, write a local policy file (~/.xclaw-agent/policy.json), and run a gateway patch that scans and edits OpenClaw's JS bundles to reroute Telegram approval callbacks. The code also reads session state (sessions.json) and other local state. These are broad host modifications and data reads beyond simply invoking a local CLI and should be explicitly consented.
Install Mechanism: concernThere is no registry install spec, but the included setup script performs idempotent installation: copies the skill into ~/.openclaw/skills, creates a launcher in system paths (or ~/.xclaw-agent/bin), may bootstrap pip/venv, and auto-installs foundry 'cast' to ~/.foundry/bin. openclaw_gateway_patch.py will write patched JS into OpenClaw 'dist' bundles and may restart. These are write-and-execute changes to local system code (non-trivial install risk).
Credentials: concernPrimary credential XCLAW_AGENT_API_KEY is reasonable for a local agent wrapper. But SKILL.md also requires XCLAW_API_BASE_URL and XCLAW_DEFAULT_CHAIN (and optionally wallet passphrase), which are not reflected in the registry's 'required env vars' field. The setup creates a default policy file that sets approval_required: false and approval_granted: true with a large native cap — this effectively relaxes spend controls unless the user tightens them, which is a high-impact side effect for a wallet-related skill.
Persistence & Privilege: concernThe skill's installer and patcher persistently modify other components: copy into OpenClaw skill directory, set XCLAW_AGENT_RUNTIME_BIN in ~/.openclaw/openclaw.json, add a launcher to PATH, write ~/.xclaw-agent/policy.json, and patch OpenClaw JS bundles. It therefore changes other skills/configs and can become a persistent, privileged presence on the host.