ClawHub
Back to skill

Security audit

Skill Installer

Security checks across malware telemetry and agentic risk

Overview

This skill openly manages skill installation and updates, but its instructions can change future agent behavior across workspaces without consistently requiring review or confirmation.

Install only if you want an agent to manage OpenClaw skills for you. Require explicit approval for every install, update, and CLI setup step; review third-party skill contents before enabling them; avoid `clawhub update --all` unless you have checked what will change; and verify where changes will be written (`~/.openclaw/workspace`, `~/.skills/`, and any symlinked agent directories).

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The document establishes a safety requirement not to auto-install without user confirmation, then later describes flows where the agent appears to perform installation automatically. This inconsistency can cause an agent implementation to execute package installation or skill installation without an explicit approval step, creating a pathway for unintended system changes and third-party code introduction.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The README explicitly states that skills are automatically installed into the global ~/.skills/ directory, which implies filesystem modification in a shared user location without any accompanying warning, consent flow, or safety guidance. In the context of a skill installer that fetches artifacts from external registries, normalizing silent writes to a global directory increases the risk of users installing untrusted or malicious content that persists across agent platforms.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The commands shown perform installs and updates in the user's workspace, which directly changes available skills and therefore agent behavior. Without a clear warning that these actions modify local state and may introduce untrusted third-party capabilities, users and agent implementations may treat them as harmless informational commands and apply them too freely.

Natural-Language Policy Violations

High
Confidence
96% confidence
Finding
The WhatsApp section says users can send `clawhub install <slug>` and that the agent will handle installation, which conflicts with the earlier prohibition on automatic installation without confirmation. In a messaging context, this is more dangerous because short natural-language or copied commands may trigger remote package retrieval and local environment modification with little friction or visibility.

Ssd 4

Medium
Confidence
81% confidence
Finding
The workflow language is ambiguous enough to imply the agent may install the CLI as part of its normal process despite the earlier instruction not to do so without confirmation. Ambiguous operational steps are risky in agent skills because implementations often convert narrative workflow text into executable behavior.

Ssd 4

Medium
Confidence
94% confidence
Finding
The WhatsApp flow narratively delegates CLI installation and setup work to the agent without preserving the prior user-confirmation safeguard. Because this is a conversational channel, the implied automation increases the chance of silent environment changes and accidental installation of unreviewed tooling or skills.

Self-Modification

High
Category
Rogue Agent
Content
clawhub search "<query>"
```

### Update skills

```bash
# Update a specific skill
Confidence
84% confidence
Finding
Update skill

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.