node-connect

Security checks across malware telemetry and agentic risk

Overview

This is a coherent troubleshooting guide for OpenClaw node pairing, with the main thing to watch being that one suggested command approves a pending device.

This skill appears safe for troubleshooting OpenClaw pairing issues. Use care with the device approval command: check the pending request first and only approve a device you recognize.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI02: Tool Misuse and Exploitation
Info
What this means

The agent may ask to run commands that show URLs, IPs, route choices, and node/device status.

Why it was flagged

The skill directs use of local diagnostic CLI commands to inspect OpenClaw and Tailscale connection state. This is expected for troubleshooting, but users should understand these commands may reveal local network configuration.

Skill content
openclaw config get gateway.mode
openclaw qr --json
openclaw devices list
openclaw nodes status
...
tailscale status --json
Recommendation

Review command output before sharing it externally, especially if it contains private network names, URLs, or device identifiers.

#
ASI03: Identity and Privilege Abuse
Low
What this means

If run without checking, the command could approve the wrong pending device if more than one request exists or if an unexpected request arrived.

Why it was flagged

Approving the latest pending device changes device authorization. This is purpose-aligned for a pairing troubleshooting skill, but it grants access to whichever request is latest.

Skill content
If the app says `pairing required`:

- network route and auth worked
- approve the pending device

```bash
openclaw devices list
openclaw devices approve --latest
```
Recommendation

Before approving, confirm the pending device is the one you are trying to pair; prefer approving an explicit device/request ID if the CLI supports it.