OpenClaw Safety Guard

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:40 AM UTC
• Version: 1.0.0

Overview

This is a coherent safety-checking CLI skill, but users should understand it installs a third-party Homebrew tool and may send submitted content to cloud providers.

Before installing, decide whether you trust the external Homebrew tap and safety-guard binary. Do not run it on confidential files, private URLs, or regulated data unless you are comfortable with the selected model provider and optional Firecrawl or Apify services receiving relevant content or metadata.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Third-Party Homebrew Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Unpinned third-party dependency from an external Homebrew tap **Risk Level**: Medium **Code Snippet**: ```yaml metadata: {"clawdbot":{"emoji":"🧾","requires":{"bins":["safety-guard"]},"install":[{"id":"brew","kind":"brew","formula":"steipete/tap/safety-guard","bins":["safety-guard"],"label":"Install safety-guard (brew)"}]}} ``` ### Technical Analysis The Skill declares `steipete/tap/safety-guard` as an installation dependency without specifying an immutable version, source commit, cryptographic checksum, or signature. Because the formula is maintained in an external Homebrew tap, its installation logic and referenced artifacts can change after this Skill has been reviewed. This is a supply-chain trust issue: reviewing the two files in this package does not establish the safety of the external formula or executable that users will later install. If the tap, its maintainer account, release infrastructure, or an upstream artifact is compromised, the dependency could be replaced with malicious content while the Skill package itself remains unchanged. The project contains no executable source code for the `safety-guard` binary, so the binary's runtime handling of local files, URLs, and configured API credentials cannot be independently verified from this artifact. ### Attack Path 1. An attacker compromises the external Homebrew tap, a maintainer account, or an upstream artifact referenced by the formula. 2. The attacker modifies the formula or distributed binary to include malicious installation or runtime behavior. 3. A user follows the Skill's installation metadata and installs `steipete/tap/safety-guard`. 4. Homebrew retrieves and executes the externally controlled installation logic or installs the modified binary. 5. The malicious component executes with the privileges of the installing or invoking user. 6. When subsequently invoked ...[truncated 657 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to an immutable, reviewed release or source commit rather than a mutable formula reference. - Publish and verify cryptographic checksums or signatures for downloaded binaries. - Prefer a trusted distribution channel with reproducible builds, release provenance, and artifact attestation. - Pin the Homebrew formula revision where supported and ensure the formula itself pins upstream artifacts by version and checksum. - Document verification commands users can run before installation. - Review the CLI source and build process, particularly its handling of local files, environment-based API credentials, and outbound network requests. - Use least-privilege execution and avoid installing or invoking the dependency with administrative privileges unless strictly required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly encourages scanning URLs, local files, PDFs, images, audio, and YouTube links while documenting multiple external model and extraction providers, but it does not warn users that submitted content may be transmitted off-host to third-party services. This creates a real privacy and data-handling risk because users may provide sensitive local files or confidential URLs under the assumption processing is local.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The provided manifest context describes this skill as "safety-guard" for guarding URLs or files with a safety-checking CLI, but the file metadata sets the slug to "summarize". That indicates a semantic mismatch between the skill's claimed purpose and its packaged identity, which can mislead users or tooling about what the skill actually does.

Static analysis

No suspicious patterns detected.