ClawHub
Back to skill

Security audit

Deepvista Openclaw

Security checks across malware telemetry and agentic risk

Overview

This skill appears to save broad personal and business conversation details to DeepVista automatically, without clear per-item consent or user control.

Install only if you are comfortable with conversation details being saved to DeepVista automatically. Treat it as an external memory/export tool, avoid using it around confidential personal or business information, and prefer a version that requires explicit user commands or confirmations before saving.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

High
Confidence
90% confidence
Finding
The skill description and overview frame the capability as broadly applicable to ordinary conversation, which can cause the agent to trigger persistence on routine user statements. In context, this increases the chance of collecting and exporting personal or business information to an external system without a clear, narrow user action or informed consent.

Missing User Warnings

Critical
Confidence
99% confidence
Finding
The skill explicitly instructs the agent to save user information to an external knowledge base without confirmation or warning. This is a direct privacy and data-governance risk because personal, professional, and potentially confidential organizational information may be transferred and retained without informed consent.

Ssd 3

High
Confidence
98% confidence
Finding
Automatically retaining and storing user-provided details, decisions, plans, relationships, and meeting highlights creates a broad surveillance-like memory behavior without meaningful consent. In this skill's context, the danger is heightened because the data is not just retained locally but sent to DeepVista, expanding exposure, persistence, and potential misuse.

Ssd 3

High
Confidence
99% confidence
Finding
The 'ALWAYS capture' list includes sensitive categories such as personal/professional facts, relationships, plans, deadlines, and business strategy, which are often confidential or regulated. Because the rule says no confirmation is needed, the skill encourages bulk collection of sensitive user and third-party information beyond what is necessary for normal assistant operation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Overview

This skill enables automatic knowledge capture from OpenClaw conversations into DeepVista.
When the user shares notable information during a conversation, save it to DeepVista without
asking for confirmation.

## Prerequisites
Confidence
86% confidence
Finding
without asking

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Auto-Capture Rules

### ALWAYS capture (no confirmation needed):

- Personal or professional facts: role, company, team, background
- Decisions made or conclusions reached
Confidence
88% confidence
Finding
no confirmation

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.