ClawHub
Back to skill

Security audit

全闭环管道

Security checks across malware telemetry and agentic risk

Overview

This is a small local pipeline wrapper that runs fixed OpenClaw workspace scripts and writes local status logs, with no evidence of hidden exfiltration or destructive behavior.

Install this only if you trust the downstream skills it calls, especially the hunter, orchestrator, dashboard, profit, and resilience components. Be aware that its logs may contain snippets of business or operational output, so review or clear the pipeline_logs directory if that data is sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_step(name, cmd, timeout=30):
    print(f"  ▶ [{name}]  执行中...", end=" ", flush=True)
    try:
        r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
        status = "✅" if r.returncode == 0 else "⚠️"
        output = r.stdout[:200] + (r.stderr[:100] if r.stderr else "")
        print(f"{status} (code={r.returncode})")
Confidence
95% confidence
Finding
r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.