ClawHub
Back to skill

Security audit

OpenClaw Tally

Security checks across malware telemetry and agentic risk

Overview

This is a local-only task analytics library with disclosed integration requirements, though its privacy wording should be clearer about stored summaries and test database paths.

Install only if you are comfortable with a local task ledger that may record task summaries, costs, model names, session IDs, tool metadata, and cron/task history. Before enabling any hook integration, confirm exactly which messages it observes and where the SQLite database will be written.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The PRD claims a privacy guardrail of 'No task content stored — only metadata,' but the schema includes `intent_summary` and `outcome_summary`, which are derived from user and assistant content. Even short summaries can capture sensitive business, personal, or regulated information, creating a mismatch between stated privacy guarantees and actual data handling.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The constructor documentation says caller-supplied dbPath is ignored for security, but the implementation actually accepts and uses it after validation. This kind of security-signaling mismatch is dangerous because integrators may assume the database location is fixed and safe, while an attacker controlling configuration or plugin inputs can redirect writes to attacker-chosen files under ~/.openclaw/tally or temporary directories, enabling data tampering, confusion, or unintended cross-context database use.

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
The comment and error text imply only ~/.openclaw/tally is permitted, but the validator also allows /tmp and /private/tmp. Allowing temporary-directory databases weakens isolation because tmp locations are less trustworthy, easier to influence operationally, and can cause ledger data to be redirected to ephemeral or shared locations contrary to user expectations.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"migrate": "node -e \"import('./src/ledger.js').then(m => new m.TaskLedger().init())\""
  },
  "dependencies": {
    "better-sqlite3": "^13.0.2",
    "zod": "^4.4.3"
  },
  "devDependencies": {
Confidence
95% confidence
Finding
The dependency uses a caret range (^13.0.2), which permits automatic installation of newer compatible versions. While common in JavaScript projects, this weakens supply-chain integrity and can expose consumers to unexpected or compromised upstream releases if the lockfile is absent or ignored.

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "better-sqlite3": "^13.0.2",
    "zod": "^4.4.3"
  },
  "devDependencies": {
    "vitest": "^4.1.10"
Confidence
95% confidence
Finding
The zod dependency is specified with a caret range (^4.4.3), allowing resolution to future patch/minor releases. This creates a modest supply-chain risk because builds may not be fully reproducible and a malicious or flawed upstream release could be pulled in unexpectedly.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"zod": "^4.4.3"
  },
  "devDependencies": {
    "vitest": "^4.1.10"
  },
  "engines": {
    "node": ">=22"
Confidence
92% confidence
Finding
The devDependency vitest is also unpinned with a caret range (^4.1.10), which can introduce non-reproducible test environments and supply-chain exposure during development or CI. Although this is less severe than a runtime dependency, compromised developer tooling can still affect builds, test results, or CI execution.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.