ClawHub
Back to skill

Security audit

Skill Lifecycle

Security checks for vulnerabilities and agentic risk

Overview

This skill manages OpenClaw skill usage records and manual archiving/restoring, with no evidence of hidden data theft or destructive behavior outside its stated purpose.

Install only if you want a tool that tracks skill usage and can manually archive or restore skills. Review skill names before running archive or restore commands, because those commands move skill directories in your OpenClaw workspace.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
mv "$ARCHIVE_PATH" "$RESTORE_PATH" && {
    echo "✅ 已恢复: $SKILL_NAME"
    bash "$SKILLS_DIR/skill-lifecycle/record-usage.sh" "$SKILL_NAME" "restored"
    rm -f "$RESTORE_PATH/_archive_meta.json"
} || echo "❌ 恢复失败"
Confidence
95% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

No suspicious patterns detected.