Security audit

Self Improving Domotics

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed smart-home note-taking and reminder workflow with optional hooks, and I found no hidden device control, exfiltration, or destructive behavior.

Install this if you want a domotics-focused logging workflow. Review the optional hook setup before enabling it, especially because hooks can persist across sessions and the Bash output detector may trigger reminders from broad smart-home terms. Do not store lock codes, alarm codes, credentials, or private household schedules in the learning files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 73% confidence
Finding: The skill includes network-capable behaviors such as cloning from GitHub and installing hooks under a user home directory, but it declares no permissions or capability boundaries. This creates a transparency and trust problem: users may approve a seemingly documentation-only skill without realizing it can reach the network and modify persistent local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The description frames the skill as capturing and analyzing domotics learnings, but the content also enables persistent hooks, scans tool output, injects reminders, and scaffolds new skills on disk. This mismatch can mislead users about the real execution and persistence surface, increasing the chance they grant trust or install it in contexts where code-executing behavior is inappropriate.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The skill explicitly claims to be documentation/reminder-only, yet it instructs running an extraction helper that creates new skills on disk. That inconsistency expands the write surface and can surprise users, especially because generated skills are themselves untrusted artifacts that may later be loaded or shared.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The document says hooks must be project-scoped and not user-level or global, but earlier instructions copy hooks into ~/.openclaw and enable them persistently. That contradiction can lead to broader-than-intended activation across sessions and workspaces, creating an unnecessary persistence mechanism and increasing the blast radius of any hook misuse or misconfiguration.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The automatic activation matcher uses broad terms like sensor, device, scene, or automation, which can appear in many unrelated contexts. Overbroad matching can trigger the skill unexpectedly, causing unnecessary prompt interception, reminder noise, and accidental processing of unrelated workstreams.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The advanced hook repeats the same broad matcher pattern and additionally couples it with PostToolUse-based output inspection. This compounds the risk of unintended activation because unrelated Bash activity may be analyzed and used to emit reminders based on loosely related keywords.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.