Security audit

TinkerClaw Shell Security

Security checks across malware telemetry and agentic risk

Overview

This skill appears to include installer scripts that modify and rebuild an OpenClaw codebase, which is high-impact behavior for a command-classification skill.

Review this before installing. Only run the patch scripts against a trusted, expected OpenClaw checkout, inspect the exact source changes first, and make sure you have a clean backup or version-control rollback. Treat the rebuild step as code execution from that checkout. I did not see evidence of exfiltration or destructive behavior, so this is Review rather than malicious.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The skill metadata and prose claim this is an instruction-only classifier that does not execute commands or modify systems, but the finding indicates the broader skill behavior includes patching source files, creating backups, and rebuilding external projects. That kind of description-behavior mismatch is dangerous because it can cause operators to grant trust and privileges under false assumptions, especially in a root-capable agent context.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This script does more than classify shell commands: it rewrites a TypeScript file in an external OpenClaw codebase, inserts a global hook, rebuilds the project, and instructs the user to restart a service. That creates a powerful code-modification and execution-pipeline alteration capability that is not transparently aligned with the declared skill purpose, increasing supply-chain and integrity risk if the patch is wrong, abused, or applied to an unexpected codebase.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script performs direct source rewriting with sed, creates backups, rebuilds the project with pnpm/npm, and changes behavior of tool execution in another application. Even if intended to enable security hooks, these are privileged, side-effectful installation actions that exceed the narrow scope of a command-classification skill and can break builds, alter trust boundaries, or introduce unintended execution control.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script does more than remove a patch: it changes source files and then invokes the target project's build process via pnpm or npm. Running a build executes arbitrary package scripts and toolchain code from the target repository, which expands this script from a file-edit helper into a code-execution primitive if OPENCLAW_DIR points to an untrusted or compromised project checkout.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.host_platform_source_patch

Install code patches host platform source and rebuilds without confirmation.

Critical

Code: suspicious.host_platform_source_patch
Location: scripts/patch-openclaw.sh:38

Install code patches host platform source and rebuilds without confirmation.

Critical

Code: suspicious.host_platform_source_patch
Location: scripts/unpatch-openclaw.sh:24