Security audit

🖥️ Canvas-OS

Security checks across malware telemetry and agentic risk

Overview

Canvas-OS appears to be a legitimate Canvas app helper, but it needs review because its helper scripts can forcibly stop unrelated local processes and its active Canvas/deep-link flows have limited guardrails.

Install only if you are comfortable with a local UI helper that starts background HTTP servers, injects active HTML/JavaScript into Canvas, and lets Canvas pages send messages back to the agent. Before using it, avoid untrusted HTML or remote content, check what is listening on a port before allowing the helper to kill it, prefer binding servers to 127.0.0.1, and treat any openclaw:// callback as an untrusted request requiring user confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly instructs the agent to run shell commands such as starting a Python HTTP server, killing processes on a port, changing directories, and invoking OpenClaw CLI actions, yet it declares no permissions. This creates a permission-model mismatch that can lead to users or policy systems underestimating the skill's execution capabilities and increases the chance of unintended command execution without appropriate review.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The helper deliberately constructs an eval action that runs JavaScript to call document.write() with arbitrary caller-supplied HTML. This enables direct script/markup injection into a Canvas target and can be used to execute untrusted content, bypass normal file/path restrictions, and potentially run active content in the target environment.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documentation presents the feature as a benign workaround for file path restrictions, but the implementation actually performs script-based HTML injection via an eval action. That mismatch increases risk because reviewers or downstream users may underestimate the capability and use a dangerous helper without understanding that it executes active content.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The tracker UI includes functionality that launches an external OpenClaw agent through a custom deep link, and user interactions can trigger that handoff. In a generic tracker template this is security-relevant because it creates a bridge from local UI actions to agent execution without clear necessity, making it easier to exfiltrate behavioral data or trigger unintended agent-side actions.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The quick-start phrases are generic natural-language commands that could easily overlap with normal user requests, causing the skill to activate unintentionally. In a skill that can launch local apps, inject JavaScript, and receive commands back from the UI, overly broad triggers increase the chance of accidental execution and unsafe capability exposure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README explicitly describes serving app content over localhost, injecting data via JavaScript eval, and accepting commands back through deep links, but provides no warnings or guardrails. That combination creates a meaningful attack surface: eval can enable script injection, localhost serving can expose local app content unexpectedly, and callback/deep-link flows can let rendered content influence agent behavior if inputs are not strictly validated.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The quick-command phrases are very broad natural-language triggers such as "Open [app]" and "Build me a [type]," which can easily overlap with ordinary conversation. In a skill that can start servers, navigate Canvas, inject JavaScript, and modify UI state, accidental invocation could cause unintended execution of shell commands or UI actions based on casual user phrasing.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documented sequence includes `lsof -ti:$PORT | xargs kill -9`, which forcefully terminates whatever process is bound to the selected port without validating ownership or warning the user. In context, this can disrupt unrelated local services, cause data loss, or terminate security-relevant or development processes if the port choice overlaps with another application.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script unconditionally kills any process listening on the user-supplied port using `kill -9`, without verifying ownership, purpose, or whether the process belongs to this app. A caller can choose a port used by another local service and forcibly terminate it, causing denial of service and possible data loss because SIGKILL prevents graceful shutdown.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The page sends action-derived messages to an external custom URL scheme via sendToJarvis without user-facing disclosure or confirmation. Because toggling items and using the add button can transmit tracker contents and activity to another component, users may unknowingly leak personal routine data or trigger privileged downstream behavior.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.