Security audit

OpenClaw Leaderboard

Security checks across malware telemetry and agentic risk

Overview

The skill does what it claims, but it encourages publishing financial proof and agent prompts/configuration without enough privacy safeguards.

Install only if you are comfortable with a public leaderboard model. Before submitting, redact screenshots and links, avoid uploading dashboards with names, balances, account IDs, emails, or transaction details beyond what is needed, and do not submit raw system prompts, secrets, customer data, internal policies, or proprietary configuration. Store any API key in a protected secret store or locked-down local file, and use only the intended leaderboard domain.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (23)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly says each submission captures model, tools, and system prompt so others can learn, but it provides no warning that prompts and configuration often contain secrets, private business logic, or safety constraints. In this context, encouraging public disclosure makes accidental exfiltration of sensitive agent internals much more likely.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The example payload normalizes including a full `systemPrompt` without any caution, which can lead users to paste confidential instructions, embedded secrets, or internal policies into a public service. Because examples strongly influence user behavior, this creates a practical disclosure risk rather than a merely theoretical one.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The screenshot upload flow instructs users to upload proof images and reuse public URLs, but it does not warn that screenshots may expose financial records, personal identifiers, account balances, transaction history, or other sensitive content. Since the uploaded blob URL is intended for public verification, users may unintentionally publish data they assumed would stay private.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The API exposes a public proof-upload endpoint and public submission workflow that encourages users to share screenshots or proof URLs, but the spec contains no warning that uploaded proof may include sensitive information such as wallet addresses, balances, account identifiers, metadata, or private dashboard content. In this skill context, users are specifically asked to prove earnings publicly, which increases the likelihood of accidental oversharing and privacy harm even if the backend is functioning as intended.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill encourages users to submit rich metadata including proof URLs, descriptions, system prompts, model identifiers, tools, and freeform configuration notes, but it does not clearly warn that these fields and uploaded proof may be publicly visible. This can lead users to disclose sensitive operational details, internal prompts, customer information, or proprietary agent configurations that cannot be easily revoked once published.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill recommends storing the API key in memory or in a local JSON file, but it does not warn users to protect that file with restrictive permissions or secure storage. On shared systems, developer workstations, synced home directories, backups, or logs, an exposed credentials file could let another party impersonate the agent and submit or manage leaderboard data as that identity.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The submitEarning function sends optional fields such as systemPrompt, modelConfig, configNotes, tools, and model/provider metadata to a third-party leaderboard service. These fields can contain highly sensitive operational details, secrets, or proprietary prompts, and this file provides no explicit consent gate, redaction, or warning before exfiltrating them off-box. In the context of an agent skill, that makes accidental leakage more likely because agents may pass internal state or prompt data directly into the tool.

Missing User Warnings

Medium

Confidence: 79% confidence
Finding: The register function returns the freshly issued API key directly in tool output. In agent and orchestration environments, tool outputs are often logged, displayed to other components, stored in transcripts, or exposed to users beyond the intended recipient, which can lead to credential disclosure and later unauthorized submissions or account access. The brief 'save your API key' note is helpful but does not mitigate the core exposure risk of placing the secret in normal output.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly tells users that submissions capture config, tools, and system prompts for a public leaderboard, but provides no privacy or redaction warning. System prompts and configuration often contain secrets, internal instructions, endpoints, customer data, or deployment-specific controls, so normalizing public disclosure can lead to credential leakage and operational compromise.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The example API call includes a raw systemPrompt field sent to a remote public service with no caution that prompts may embed sensitive instructions, tokens, customer context, or internal policy text. Because examples strongly shape user behavior, this materially increases the chance that operators will exfiltrate confidential prompt content verbatim.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The field documentation says sharing the system prompt helps others learn, but omits any warning that prompts frequently contain sensitive operational details. This encourages disclosure of internal instructions in a public context and can expose guardrails, proprietary workflows, or embedded secrets.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The screenshot upload workflow invites users to upload proof images to public storage without warning that screenshots may reveal personal, financial, account, or authentication information. Uploaded dashboards and transaction pages often include balances, names, email addresses, account IDs, and session-adjacent data that could be abused if publicly exposed.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Encouraging publication of an agent's system prompt and configuration creates a direct data-disclosure path for sensitive operational knowledge, including hidden instructions, guardrails, partner integrations, and possibly secrets copied into prompts. In a finance-related leaderboard, these disclosures can aid prompt extraction, imitation, abuse, or credential exposure.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The example request asks for the full system prompt, which socially normalizes disclosure of the most sensitive part of an agent's operating instructions. Attackers or competitors can use such prompts to replicate strategy, identify weaknesses, or harvest accidentally embedded secrets.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The field documentation explicitly says sharing the system prompt helps others learn, which encourages users to disclose internal instructions in natural language. This is dangerous because natural-language fields often bypass technical controls and may contain secrets, policies, or exploitable behavioral cues.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The tips section incentivizes disclosure by suggesting that sharing config, tools, and prompt information increases trust and verification success. Tying social or ranking benefits to disclosure increases the likelihood that users reveal more sensitive information than intended.

Ssd 3

Low

Confidence: 88% confidence
Finding: The rationale section frames public sharing of model, tools, and prompt details as a community benefit, reinforcing unsafe norms around publishing internal agent setup. Even if meant benignly, this increases aggregate exposure of sensitive prompts and operational details across users.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The workflow promotes publishing full system prompts and configuration details to a public leaderboard as a normal part of participation. In this context, the danger is elevated because prompt/config internals are often deployment secrets or reveal how to bypass safety and operational controls.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The example payload directly instructs users to include their system prompt in the submission body. This is dangerous because it turns potentially sensitive internal instructions into publicly transmitted content and makes accidental disclosure more likely through copy-paste use of the sample.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The field documentation explicitly requests the system prompt and frames it as beneficial for others, which normalizes exposing sensitive internal instructions. Publicly disclosing prompt text can reveal proprietary methods, security constraints, hidden instructions, or embedded credentials.

Ssd 3

Low

Confidence: 88% confidence
Finding: The tips section encourages sharing config and prompt information to gain community trust, creating social pressure to disclose more than is safe. While indirect, this still increases the likelihood that users publish sensitive setup details they would otherwise keep private.

Ssd 3

Low

Confidence: 90% confidence
Finding: The 'Why Submit?' section promotes sharing config, tools, and prompts as a learning mechanism, reinforcing public disclosure of sensitive internals. In a public leaderboard context, this broad encouragement can lead users to reveal proprietary or security-relevant implementation details beyond what is necessary for verification.

Known Vulnerable Dependency: next==16.1.6 — 10 advisory(ies): CVE-2026-44575 (Next.js has a Middleware / Proxy bypass in App Router applications via segment-p); CVE-2026-45109 (Next.js has a Middleware / Proxy bypass in App Router applications via segment-p); CVE-2026-44573 (Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n) +7 more

High

Category: Supply Chain
Confidence: 98% confidence
Finding: next==16.1.6

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: openclaw-skill/tool.js:5

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/generate-images.ts:66

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/lib/auth.ts:20