node-connection-doctor

• Outcome: Review
• Latest audit: May 29, 2026, 9:28 PM
• Version:
  1.0.3

Overview

This looks like a real OpenClaw troubleshooting skill, but it needs review because it requests background scheduling permission and advertises automatic repairs that can reset pairing tokens and restart services without enough scoping or rollback detail.

Install only if you intend to let this skill manage OpenClaw node connectivity. Run diagnosis first, keep repair confirmation enabled, back up OpenClaw config before fixes, expect token resets and gateway restarts to interrupt pairing/connectivity, and avoid granting cron/background permission unless you deliberately want scheduled monitoring.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README explicitly documents a silent automatic fix mode with `auto_confirm: true` that performs disruptive administrative actions such as token reset, rebinding, gateway restart, and config recovery without an interactive safeguard or strong warning. In the context of a node-management skill that requires admin/root privileges, this increases the risk of accidental service disruption, invalidation of existing trust relationships, or unintended configuration rollback if invoked by automation or an inattentive operator.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README advertises automatic fixes that can reset tokens and restart the gateway, but it does not clearly describe the operational impact, such as temporary loss of connectivity, invalidation of existing pairing state, or disruption to dependent services. In a system administration skill, presenting state-changing repair actions as 'safe' without prominent cautions can lead users to trigger destructive or availability-affecting actions too casually.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill advertises 'one-click' repair actions such as resetting pairing tokens, rebinding the gateway, and restarting services, which are state-changing operations with operational and security consequences. Although the text mentions confirmation is required, it does not clearly describe the risks, scope of changes, rollback options, or safeguards, so users may trigger disruptive or security-relevant changes without informed consent.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The manifest description says the skill will 'Automatically diagnose and fix OpenClaw node connection issues,' which signals broad automatic action without any stated trigger boundaries, approval requirements, or scope limits. In a troubleshooting skill that may change networking or node configuration, vague auto-invocation language increases the risk that an agent invokes repairs too readily or in situations the user did not explicitly authorize.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The manifest advertises automatic diagnosis and fixing of node connection issues, and the pricing tier includes 'automatic fix execution,' but there is no visible warning in the manifest about system-changing actions such as modifying gateway, networking, or Tailscale-related settings. Because this skill operates in a troubleshooting context with potentially sensitive infrastructure changes, users and calling agents may underestimate the operational and security impact of running repairs.

VirusTotal

64/64 vendors flagged this skill as clean.