ClawHub
Back to skill

Security audit

soft-ip-full-lifecycle-delivery-pro

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed paid document-drafting workflow that stores local order details for payment verification, with no evidence of hidden exfiltration or destructive behavior.

Before installing, avoid putting source code, applicant identities, company secrets, or other sensitive details into the initial software description unless you are comfortable with that text being saved in a local OpenClaw order file. Review local file permissions on shared machines and use the documented clawtip flow for payment verification.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="Create order for software copyright filing document service"
    )
    parser.add_argument("question", help="Software description / user request")
    args = parser.parse_args()
Confidence
90% confidence
Finding
The script persists order data, including the user-supplied question, payTo, order number, and possibly plaintext payment metadata, under the user's home directory without applying restrictive file permissions or data minimization. In this skill context, the question may contain sensitive business, copyright, or applicant details despite the comments claiming such data is not stored, so local persistence increases exposure to other local users, backups, or malware.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.