ClawHub
Back to skill

Security audit

Mai

Security checks across malware telemetry and agentic risk

Overview

Mai is a disclosed shopping and marketplace helper with local storage, optional registry networking, and user-confirmed write operations.

Install this only if you want a commerce workflow that stores marketplace data locally and may connect to a registry you configure. For public registry use, treat it as an operator-run marketplace service: use HTTPS, protect API keys, review what catalog/order/message data is pushed, and do not use the demo payment provider as real money movement.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises substantial capabilities including filesystem, shell, environment, and network use, but does not declare permissions or clearly scope those powers in metadata. This weakens host-side trust decisions and can lead users or orchestrators to invoke a skill with more authority than expected, especially in an agent ecosystem where permission declarations are a primary safety boundary.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The declared description frames Mai as a shopping matchmaking agent, but the documented behavior extends into running a networked registry service, issuing role-bearing API keys, moderating content, and handling payment-related registry operations. That scope expansion is security-relevant because operators may install or trust it as a client-side skill while inadvertently deploying server-side administrative and payment-adjacent functionality with materially higher risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This plan expands a local-first shopping skill into a public HTTP marketplace with registry search, messaging, orders, API keys, moderation, and PSP custody flows, but it does not explicitly require user-facing privacy notices, data exposure warnings, or consent/retention guidance. In a marketplace context, merchants and buyers may expose product data, messages, order details, identifiers, and payment-related records to remote services without understanding that data is no longer local-only, increasing privacy, compliance, and accidental disclosure risk.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
class MaiInstallTest(unittest.TestCase):
    def run_install(self, home, *args):
        env = os.environ.copy()
        env["HOME"] = str(home)
        return subprocess.run(
            ["bash", str(ROOT / "scripts" / "install.sh"), *args],
Confidence
60% confidence
Finding
os.environ.copy()

Credential Access

High
Category
Privilege Escalation
Content
assert plugin_package["openclaw"]["build"]["openclawVersion"] == "2026.5.2"
assert (root / "Dockerfile").exists()
assert (root / "docker-compose.yml").exists()
assert (root / "registry.example.env").exists()

openai_yaml = (root / "agents" / "openai.yaml").read_text(encoding="utf-8")
assert 'display_name: "Mai"' in openai_yaml
Confidence
60% confidence
Finding
.env"

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
plugins/mai-plugin/openclaw_compat.js:74