Mainctrl

• Outcome: Pass
• Latest audit: Jul 3, 2026 · 3:16 PM UTC
• Version: 1.3.0

Overview

This skill is a disclosed OpenClaw safety-control tool with real administrative power, but the reviewed behavior matches its stated purpose and shows no hidden exfiltration or destructive intent.

Install only if you want a user-invoked administrative guard that changes OpenClaw tool-routing behavior. Treat it as a delegation aid, not a security boundary: sub-agents remain able to write and execute, the guard can be turned off, and missing/corrupt state fails open. Review plugin install/remove and MEMORY.md use before relying on it in sensitive workflows.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is described as a runtime safety guard that blocks destructive tools for controlled agents, but this script also modifies a global MEMORY.md file and performs plugin lifecycle operations. Those extra capabilities expand the trust boundary and create side effects outside the stated purpose, which is dangerous because operators may grant or invoke the skill assuming it is only a local guard toggle.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Embedding plugin installation and removal in a safety-guard script gives the tool the ability to change the host's plugin set, which is a privileged administrative action unrelated to merely enforcing runtime blocking. If invoked unexpectedly, it can alter execution behavior, introduce unreviewed code paths, or disable protections by changing plugin state.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README documents an `off` mode as an emergency bypass that causes all blocked destructive actions to pass through, but it does not pair that guidance with a strong warning about the security consequences or recommended operational constraints. In a safety-control skill, normalizing an easy global disable increases the chance of accidental or socially engineered deactivation, especially because the protected agent regains write and command execution immediately.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documented behavior says that if `state.json` is missing or corrupted, the plugin enters permissive mode and allows everything. For a guard intended to block destructive tools, fail-open behavior creates a straightforward bypass: deleting, renaming, or corrupting the state file disables enforcement at the next tool call.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs the agent to automatically delegate blocked operations to sub-agents without obtaining fresh user confirmation. That can bypass the practical effect of the guardrail: a restricted main agent may still cause destructive actions indirectly, reducing user visibility and weakening intent verification for sensitive operations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The install/remove plugin commands perform privileged, state-changing operations immediately and without an interactive confirmation or explicit warning at execution time. In an agent-driven environment, this increases the chance of accidental or unintended plugin changes that could disable protections or load code from an unreviewed local path.

Session Persistence

Medium

• Category: Rogue Agent

Content

| `./scripts/mainctrl.sh agents '<json-array>'` | Set which agents are controlled     |
| `./scripts/mainctrl.sh tools '<json-array>'` | Set or show blocked tools list      |
| `./scripts/mainctrl.sh allow-except '<json>'` | Set execAllowExcept config (JSON object) |
| `./scripts/mainctrl.sh refresh-memory`    | Write current status to ~/.openclaw/workspace/MEMORY.md |
| `./scripts/mainctrl.sh plugin install` | Install the companion plugin via openclaw plugins |
| `./scripts/mainctrl.sh plugin remove`  | Disable and uninstall the companion plugin       |

• Confidence: 82% confidence
• Finding: Write current status to ~/.openclaw

VirusTotal

54/54 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.