ClawHub
Back to skill

Security audit

OpenClaw session maintain helper

Security checks across malware telemetry and agentic risk

Overview

This is a small session-management helper whose main risk is accidental or insufficiently confirmed changes to chat context.

Install this only if you want help managing OpenClaw session context. Treat /compact, /new, and /reset as deliberate actions, and confirm them explicitly because they can compress, replace, or reset the working context of an active conversation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill advertises broad trigger phrases such as 'fresh slate', 'new session', and 'reset session', which can appear in normal conversation and may cause unintended invocation of a session-changing skill. Because this skill can compact, reset, or start a new session, accidental triggering could disrupt user state, discard useful context, or push the agent toward a destructive workflow the user did not actually intend.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill treats /reset as needing confirmation only 'less critical' than /new, even though reset is still a disruptive session-changing action. This weaker safety requirement creates a path where an agent may reset session state without a clear, explicit user warning, leading to loss of context, interruption of work, or unexpected state changes.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.