ClawHub
Back to skill

Security audit

Nutrient Openclaw

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed cloud document-processing integration that sends chosen documents or extracted content to Nutrient DWS, with no artifact-backed evidence of hidden or malicious behavior.

Install only if you are comfortable sending the documents you process, or extracted content from them, to Nutrient DWS. Use a dedicated or least-privilege API key where possible, start with non-sensitive samples, and review outputs carefully before relying on redaction, signing, or watermarking results.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill advertises activation on generic document-processing requests in OpenClaw chats, which is broader than narrowly scoped tool-name or explicit skill invocation triggers. That can cause the skill to engage on ordinary document requests and route files or extracted content to a third-party network service unexpectedly, increasing the risk of unintended data disclosure or use in contexts where the user did not mean to invoke external processing.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.