ClawHub
Back to skill

Security audit

Openclaw Security Audit

Security checks across malware telemetry and agentic risk

Overview

This skill runs a local security audit and writes local reports; its sensitive host and file scanning matches that purpose and shows no hidden upload or destructive behavior.

Install and run this only when you intend to audit the local machine or OpenClaw workspace. Keep generated reports private and review them before sharing, because they may contain usernames, hostnames, file paths, listener/process details, security posture information, and masked secret examples.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This audit routine collects the current username unconditionally and, when host scanning is enabled, also gathers system and network metadata into the report. In a security-auditing skill this may be functionally intended, but without clear consent, minimization, or disclosure in this flow, it creates a privacy and information-exposure risk if reports are stored, displayed, or exfiltrated to other components.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This code collects host-identifying information and performs local system interrogation by reading sensitive configuration/log files and invoking system commands such as journalctl, ufw, nft, iptables, systemctl, fail2ban-client, and bash. In a security scanning skill this is expected behavior, but it still creates a real privacy and capability risk if executed without explicit user awareness, consent, and least-privilege controls because it exposes details about the host and its security posture.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.