ClawHub
Back to skill

Security audit

LLM Loop Breaker

Security checks across malware telemetry and agentic risk

Overview

The skill appears defensive and mostly disclosed, but it modifies the gateway, starts a persistent watchdog, captures host logs, and can automatically kill processes, so it needs careful review before installation.

Install only on a dedicated OpenClaw gateway host where you intentionally want automatic stream abortion, host monitoring, incident log capture, and process termination. Review the injected openclaw.mjs block, dependency installation path, workspace permissions, and uninstall procedure first; avoid using it on shared or sensitive hosts unless you can tolerate possible false-positive process kills and retained host logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tainted flow: 'report_path' from os.environ.get (line 322, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
except Exception:
                dmesg_logs = 'Unable to read dmesg.'

            with open(report_path, 'w') as f:
                f.write(f'# Process Incident Report: {timestamp}\n')
                f.write(f'**Trigger**: {reason} for process `{target_process}`\n')
                if extra_info:
Confidence
80% confidence
Finding
with open(report_path, 'w') as f:

Tainted flow: 'AUDIT_LOG' from os.environ.get (line 39, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
f.write('## 2. Kernel Segfault/OOM Logs\n```bash\n')
                f.write(dmesg_logs + '\n```\n')

            with open(AUDIT_LOG, 'a') as f:
                f.write(f'\n\n**{timestamp} - SYSTEM CRITICAL EVENT**\n')
                f.write(f'{reason}. Snapshot saved to: `{report_path}`\n')
                if extra_info:
Confidence
82% confidence
Finding
with open(AUDIT_LOG, 'a') as f:

Tainted flow: 'AUDIT_LOG' from os.environ.get (line 39, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
breach_msg = ', '.join(redline_breached)
            print(f'[WARNING] PHYSICAL REDLINE BREACH: {breach_msg}', file=sys.stderr)
            try:
                with open(AUDIT_LOG, 'a') as f:
                    f.write(f'\n- **{timestamp}**: PHYSICAL REDLINE BREACH: {breach_msg}')
            except Exception:
                pass
Confidence
82% confidence
Finding
with open(AUDIT_LOG, 'a') as f:

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares no explicit permissions while clearly requiring environment access, file reads/writes, and shell execution to modify the gateway, deploy files, and launch monitoring components. This creates a transparency and consent problem: operators may approve the skill believing it is low-privilege when it can alter application code and system state.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill's stated defensive purpose omits several high-risk behaviors: patching application code, starting a persistent daemon, installing dependencies, scanning and killing processes, and collecting forensic logs from host systems. In this context, those actions are especially dangerous because the skill operates on the gateway host and can affect availability, persistence, and sensitive log exposure well beyond simple 'stream guarding.'

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script directly appends executable code into the host application's main entrypoint, changing startup behavior rather than performing a confined deployment. This creates a supply-chain style persistence point: every future application start will execute added logic, including process spawning and fetch patching, with the same privileges as the host app.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The deployment script installs system or Python packages onto the host using apt-get or pip, expanding its authority beyond copying the skill's own artifacts. This increases attack surface, can alter system state unexpectedly, and is especially risky in production or privileged environments where package installation may pull unreviewed dependencies or require root access.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The injected code launches a persistent background watchdog via shell commands and nohup, causing code execution outside the normal application lifecycle and surviving the initiating session. In a security-sensitive environment, this is dangerous because it creates stealthy persistence, complicates monitoring, and uses shell invocation paths that are harder to audit and control.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The watchdog collects and persists broad host-level logs from `journalctl`, `/var/log/syslog` or `/var/log/messages`, and `dmesg`, which can contain unrelated service events, usernames, paths, tokens, prompts, or other sensitive operational data. For a component whose stated role is resource monitoring and process control, this is excessive data access and retention that meaningfully increases privacy and confidentiality risk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script modifies the target application and enables a persistent watchdog automatically, without any interactive confirmation or explicit approval flag. Even if intended defensively, silent behavior changes at deploy time violate least surprise and can lead to unauthorized persistence and operational instability in the host environment.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
Incident reports embed raw system and kernel log content into files under the workspace without any sensitivity warning, redaction, or access-control discussion. In practice this can expose secrets or unrelated host activity to users or components that can read the workspace, expanding the blast radius of any local compromise or misconfiguration.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
deploy.sh:81