ClawHub
Back to skill

Security audit

Publish Clean

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed UI theming tool, but it mandates persistent cron-based self-healing and local preference logging that users should review before installing.

Install only if you are comfortable with a skill that can edit UI build files, inject CSS/JS, store theme preferences locally, and register a daily cron job. Before use, require explicit confirmation for file changes and cron setup, inspect crontab after installation, and use the documented uninstall path when removing a theme.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill documents reading and writing local files such as dist/control-ui/index.html, snapshot files, and feedback.json, but the manifest does not declare corresponding permissions. This creates a capability/expectation mismatch that can bypass user understanding and weaken platform policy enforcement.

Description-Behavior Mismatch

Medium
Confidence
76% confidence
Finding
The skill is presented as an OpenClaw UI theme coach, but the instructions broaden it to DSH web UI and arbitrary web projects. That scope expansion increases the chance the skill will be used in contexts with different trust boundaries, file layouts, or security assumptions than users expect from the manifest.

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
A guided design advisor should not silently extend into persistent system modification, snapshot storage, and automated self-healing. The documented workflow alters application files and establishes persistence, which materially changes the risk profile from advisory behavior to system-management behavior.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The skill mandates adding a recurring cron job to preserve theme injections. Persistence via cron is disproportionate for a theme coach and can be repurposed to reapply unwanted changes, survive upgrades, and normalize behavior similar to persistence mechanisms used by malware.

Context-Inappropriate Capability

Medium
Confidence
73% confidence
Finding
The skill encourages use of external tools, web search, clawhub content, and download scripts beyond what is necessary for theme coaching. This broadens the attack surface by introducing untrusted code, external content, and tooling into a workflow that already modifies local files.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README explicitly advertises persistent recording of user preferences (“记录用户偏好”) but does not mention consent, retention limits, visibility, or deletion controls. Even if the stored data is only theme preferences, silent persistence can create privacy and trust issues, and in some deployments those preferences may reveal user identity, tastes, or behavioral patterns over time.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs persistent recording of user preferences and history in feedback.json without a clear consent, notice, retention, or deletion policy at the point of collection. Even if the data seems low sensitivity, it creates an unnecessary local privacy trail tied to user behavior and aesthetic preferences.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger examples include broad, everyday phrases such as “试试赛博朋克” and “随便弄个好看的,” which can plausibly appear in ordinary conversation and may activate the skill without clear user intent to invoke a high-impact UI modification workflow. In this skill’s context, activation leads to theme injection, persistence/self-healing behavior, and feedback handling, so ambiguous triggers increase the risk of unintended changes or unauthorized preference persistence from casual dialogue.

Ssd 3

Medium
Confidence
88% confidence
Finding
Storing natural-language preferences and interaction history in the skill directory creates a retention risk because the data may persist across backups, syncs, or sharing of the skill directory. Over time, such files can reveal behavioral patterns without users realizing they are being logged.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
### ⚠️ 安全门槛
- 第三方 skill：verify 来源/签名 → 内容审查（有无外传数据/危险 shell）→ 用户批准 → 装后验证
- 任何一条不过就不装，风险讲清楚
- 不下载执行不明代码；skill 不内置第三方版权素材（示范/打包素材须自绘或已授权）；用户自备素材的发布授权由用户自行确认

---
Confidence
96% confidence
Finding
The cron registration command establishes recurring persistence that re-runs a local script daily. Even though framed as self-healing for themes, persistence of this kind is dangerous because it can continuously reapply modifications, resist removal unless users also edit crontab, and resembles common backdoor persistence patterns.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.