Security audit

Claude Code Collaboration

Security checks across malware telemetry and agentic risk

Overview

This skill connects OpenClaw to Claude Code as described, but it gives queued tasks broad automatic power and includes an embedded API token.

Review before installing. Do not run this as-is in a sensitive workspace or where untrusted users/processes can write queue files. Remove and rotate the embedded token, configure your own credentials securely, remove the permission-bypass flag unless you fully accept the risk, restrict the queue/work directories, and avoid submitting secrets or private code unless local logs and result files are protected.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: env["API_TIMEOUT_MS"] = "3000000" env["CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"] = "1" result = subprocess.run( ["claude", "--print", "--no-session-persistence", "--dangerously-skip-permissions", prompt], cwd=WORK_DIR,
Confidence: 92% confidence
Finding: result = subprocess.run( ["claude", "--print", "--no-session-persistence", "--dangerously-skip-permissions", prompt], cwd=WORK_DIR, capture_out

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The agent contains a hardcoded API credential and endpoint configuration, then injects them into every spawned process. This creates a direct secret-exposure path and allows anyone who can read the file, logs, memory, or influence the child process to abuse the credential and external service.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The bridge launches Claude with --dangerously-skip-permissions even though its stated role is only to relay queue tasks. In this context, untrusted queue content can instruct the downstream agent to read, modify, or exfiltrate local data with reduced safeguards, substantially increasing the blast radius.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly documents that prompts and results are written to local files and that a conversation log is kept, but it does not warn users that potentially sensitive prompts, model outputs, and errors may persist on disk. This creates a real privacy and data-handling risk because users may unknowingly route secrets, proprietary code, or personal data into files such as `.oc-cc-chat.log` and `.oc-cc-out/*.json`.

Missing User Warnings

High

Confidence: 99% confidence
Finding: A live credential is embedded directly in code and then exported into the subprocess environment without disclosure or protection. Any compromise of the bridge, child process, repository, or host can expose the token and enable unauthorized API usage.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The subprocess is launched with an explicit safety-bypass option while consuming untrusted task input from a watched queue. The lack of any user confirmation, policy gate, or warning means queued prompts can trigger powerful actions automatically, turning the bridge into a privilege-escalation mechanism.

Ssd 3

High

Confidence: 96% confidence
Finding: The logger persistently writes task content and later outputs to a plain-text log file. Because prompts may contain secrets, personal data, or operational instructions and model responses may echo sensitive material, this creates a durable local disclosure channel.

Ssd 3

High

Confidence: 97% confidence
Finding: The output artifact intentionally stores the full original prompt, stdout, and stderr in JSON. In a queue-processing bridge, this bakes sensitive input and response data into files that may be accessible to other local users, backup systems, or downstream consumers.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

No suspicious patterns detected.