Security audit

Openclaw Spacesuit

Security checks across malware telemetry and agentic risk

Overview

This skill is not evidently malicious, but it gives an agent broad local memory, transcript-reading, and cross-session behavior that should be reviewed before use.

Install only if you want a personal OpenClaw workspace framework with durable memory and local transcript/operator indexing. Before enabling it, review AGENTS.md, TOOLS.md, SECURITY.md, and sync-operators.sh; keep state/operators.json private; preview upgrades; and narrow or disable the broad search, heartbeat, memory commit, and broadcast rules in shared or sensitive environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README documents a script that parses session transcripts and extracts Slack usernames and user IDs into a derived JSON file, but it does not include clear privacy, consent, retention, or access-control guidance. Because session transcripts may contain personal data and operational context, normalizing that data into a machine-readable index increases the chance of unintended disclosure or secondary use.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The skill explicitly instructs users to run initialization and upgrade commands that create or replace workspace files, but the description does not clearly warn that these operations modify local files and may overwrite framework-managed sections. In a scaffold/framework skill this is expected behavior, but the lack of an explicit warning can still lead to unintended file changes or loss of user edits within managed regions.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The stop/stand-down trigger list includes vague catch-all wording such as 'or similar', which can cause accidental activation from ordinary conversation. In an agent control file, ambiguous shutdown triggers can be abused or can interrupt legitimate workflows unexpectedly, creating reliability and safety issues.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to 'search harder' and check workspace, cloud storage, synced drives, home config, sessions, and memory before responding, without requiring contemporaneous user confirmation or privacy gating. This encourages broad access to potentially sensitive locations and increases the chance of over-collection, cross-context disclosure, or retrieval of data the user did not intend to expose in the current interaction.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The line encourages the agent to update a core identity/persistence file ('This file is yours to evolve') without clear scope, authorization rules, or change constraints. In a system where these files act as persistent memory, ambiguous self-modification can let prompt injection, transient errors, or overbroad interpretation rewrite long-lived behavior in unsafe ways.

Ssd 3

Medium

Confidence: 96% confidence
Finding: These sections direct the agent to persist broad user context, decisions, lessons, and long-term memories across multiple files and sessions. Natural-language persistence of user information increases the risk of retaining secrets, sensitive personal data, or context from one session that may later be surfaced in another, especially because the guidance encourages frequent writing and curation.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The broadcast protocol tells the agent to propagate newly learned rules or corrections to all active sessions immediately. If a user message contains sensitive details, context-specific instructions, or adversarial content framed as a 'rule,' this mechanism can semantically spread that content across unrelated sessions and users, creating cross-context data leakage and prompt-injection amplification.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: base/SECURITY.md:40