ClawHub
Back to skill

Security audit

Skill Defender

Security checks across malware telemetry and agentic risk

Overview

This is a coherent offline scanner for OpenClaw skills, and the alarming strings appear to be detection examples rather than instructions to harm the user.

Install this if you want a local heuristic scanner for OpenClaw skills. Treat its results as advisory, review allowlisted or high-impact skills manually, and run scans only on skill directories you intend to inspect.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documentation describes scripts that can scan arbitrary skill directories, auto-discover paths, and process files, which implies shell, file-read, environment/path access, and potentially network-adjacent capabilities without any declared permissions. Even if the current file is only documentation, missing explicit permission declarations weakens the trust boundary and can cause the host to grant or infer broader access than users expect.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The allowlist suppresses entire categories for named skills, including this security tool itself, which can hide genuine detections and produce biased results. In a defender/scanner skill, that is more dangerous because consumers may rely on the output for security decisions while missing real issues in allowlisted skills.

Description-Behavior Mismatch

Low
Confidence
77% confidence
Finding
Capping findings and truncating scanner output can cause silent loss of evidence, understating the risk level of a scanned skill. In a security aggregation tool, incomplete reporting is security-relevant because downstream users may assume the report is comprehensive when it is not.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The manual trigger phrase "security check" is broad enough to match ordinary conversational requests that may not be intended to invoke this skill. This can lead to accidental execution of a filesystem-scanning action, creating unnecessary access to local skill directories and confusing or noisy behavior.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/threat-patterns.md:17