Security audit
Skill Writer
Security checks across malware telemetry and agentic risk
Overview
This is a normal instructional skill for writing and publishing OpenClaw skills, with no evidence of hidden access or harmful behavior.
Review the publishing commands before running them. Installing the skill itself appears low risk, but commands such as npx molthub@latest publish should only be used from the intended skill directory when you actually want to publish or update a skill.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
58/58 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.