ClawHub
Back to skill

Security audit

release-openclaw-mac

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill suspicious because it flagged autonomous release decisions, while missing references leave parts of the evidence incomplete; the scanners did not report malicious behavior.

Review the release instructions and check that you are comfortable with macOS publication proceeding under an explicit release request without separate consent. Treat the verdict as a reason for caution: some referenced paths were unavailable to the scan, so the evidence is incomplete.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
An explicit stable or full release request includes macOS publication unless
the operator limits its scope. Continue through validation, signing,
notarization, promotion, and verification without asking for separate macOS
consent. Keep the exact release identity and all artifact checks. macOS
publication runs in parallel with npm and never blocks it; a mac failure does
not hold the npm/ClawHub release, GitHub release finalization, or main closeout.