ClawHub
Back to skill

Security audit

Kokonna Frame

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims: it sends user-selected images and device queries to a configured KoKonna frame API, with no evidence of hidden or destructive behavior.

Install only if you intend to let OpenClaw send selected images and frame status requests to the configured KoKonna API. Verify the API host and your device keys, avoid uploading sensitive photos, and prefer confirming each upload, especially when using the option that pushes to all configured frames.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill clearly documents reading local files (images, config) and making network requests to a remote API, yet it declares no permissions. That mismatch can prevent informed consent and weakens security review because users are not explicitly told the skill can access local data and transmit it externally.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The README presents broad natural-language trigger examples without clear scoping or confirmation guidance, which can cause the skill to activate on ambiguous user requests involving displaying or sending images. In a skill that controls physical devices and uploads content to a remote API, unintended invocation can result in unauthorized image pushes or device operations.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README instructs users to configure an external API endpoint and device API keys, but it does not clearly disclose that images, device identifiers, and status queries will be transmitted to a third-party service. This omission weakens informed consent and can lead users to expose personal images or household device metadata without understanding the privacy implications.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The usage instructions encourage uploading a local image to a frame via a cloud API but do not clearly warn that the image contents leave the local machine and are sent to a third-party service. This creates privacy and data-handling risk, especially if users upload sensitive personal photos assuming communication is only with the local device.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.