Openclaw Mention Skill

• Outcome: Pass
• Latest audit: May 28, 2026 · 10:13 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed WhatsApp mention-conversion patch, but users should understand it modifies OpenClaw runtime files and stores local identity mappings.

Install only on an OpenClaw system you control after reviewing install.sh. Expect it to patch OpenClaw runtime files, restart the service, and keep local WhatsApp identifier mappings; audit LID_CACHE.json and mention-guide.md, and remove those files manually if you do not want the mappings retained after uninstall.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions even though its documented behavior and detected capabilities require environment access plus reading and writing local files. This undermines informed consent and review because installers cannot accurately assess that it patches installed code, maintains a local cache, and touches workspace files. In this context, the mismatch is more dangerous because the skill operates on WhatsApp message flow and persistent OpenClaw files, so hidden capabilities affect both privacy and system integrity.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The public description presents the skill as simple mention conversion, but the documented behavior extends to persistent patching of OpenClaw distribution files, cache management, AI memory modification, administrative tooling, backup handling, and service restarts. That gap materially hides the real security footprint of the skill, increasing the chance a user installs it without understanding that it rewrites core application behavior and stores identity-related metadata. In a messaging integration, this is especially risky because broad interception and persistent patches create a larger attack surface than the stated purpose suggests.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The README describes the skill as a mention-conversion helper, but the documented implementation modifies OpenClaw core message-delivery and login behavior. That mismatch is security-relevant because invasive hooks into core messaging paths expand the trust boundary and can enable unintended message interception, alteration, or persistence beyond the narrow feature users may expect from the skill.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: Automatic patching of core files is an invasive capability for a skill whose stated purpose is mention formatting, and it introduces supply-chain and platform-integrity risk. Because the patch intercepts all outgoing messages and modifies login/reply handling, a compromised or flawed installer could tamper with messages, capture metadata, or break security assumptions across the host application.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The installer claims to provide WhatsApp @mention functionality, but it also deploys an additional add-member.js utility that is outside the stated core purpose. Shipping extra executable functionality in an installer expands the attack surface and violates least surprise; if that utility is unsafe or later abused, users may unknowingly install capabilities they did not intend to trust.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger model is extremely broad: users are told to 'Just write @someone,' while the skill intercepts outgoing WhatsApp messages generally. Broad matching on ordinary composition can cause unintended rewrites, mis-mentions, or silent transformation of user content, particularly in chats where '@' is used for non-mention text. Because this skill sits inline on outgoing messages, false matches can affect message integrity and privacy at send time.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation does not clearly warn users that all outgoing WhatsApp messages are intercepted and potentially rewritten. This is a security-relevant omission because users may assume the skill only helps with explicit mention formatting, while in practice it has visibility into and modifies every outgoing message on the channel. In a communications tool, lack of clear disclosure increases the risk of unintended data handling and trust violations.

Static analysis

No suspicious patterns detected.