Security audit

ShieldClaw

Security checks across malware telemetry and agentic risk

Overview

ShieldClaw appears purpose-aligned as a security tool, but it asks for broad security-control permissions while leaving key behavior under-scoped or delegated to unreviewed external packages.

Install only after reviewing the referenced @shieldclaw dependencies and confirming how OpenClaw enforces Guard hooks. Before enabling it, narrow protected paths, verify logging and retention settings, avoid storing high-value secrets until the vault implementation is reviewed, and make sure there is a clear way to disable protection and delete local data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The code reads an environment variable, parses it as JSON, and uses its contents to influence module-loading behavior and runtime configuration. Allowing externally supplied environment data to redirect or alter loaded modules creates a code-loading/control-flow injection risk, especially in an integration component where environment variables are commonly user- or deployment-controlled.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The code presents a security hook framework that is supposed to intercept fs/network/process activity, but `initHooks()` only logs initialization and no actual interception is implemented. In a security skill whose purpose is real-time protection and threat detection, this creates a dangerous false sense of enforcement: rules may evaluate only if some external caller manually supplies contexts, so malicious or risky operations can proceed uninspected while users believe they are protected.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The example phrases are generic enough to overlap with normal user conversation, which can cause the skill to trigger in contexts the user did not clearly intend. In a security-focused skill, accidental invocation is more dangerous because it may start scans, alter protections, or expose/log sensitive operational context during ordinary discussion.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README states that configuration files, audit logs, a local database, and key-related handling are created automatically, but it does not clearly warn users about what data is stored, where it is stored, and when this happens. That lack of transparency can lead to unintentional retention of sensitive information and weak user consent, especially for a tool that processes secrets and security events.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The activation text says to use this skill for broadly defined 'security-related operations, threat detection, or data protection,' which is expansive enough to trigger on many sensitive user requests. Overbroad routing into a high-privilege security skill increases the chance that unrelated sensitive tasks, secrets, or monitoring actions are invoked without sufficiently specific user intent or review.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The Vault and Audit sections describe storing sensitive data, masking, encryption, and persistent audit logging, but they do not clearly warn users what data will be retained, where it is stored, how long it is kept, or who can access it. In a security-themed skill, users may be especially likely to trust it with secrets, so missing privacy and retention disclosures materially increase misuse and over-collection risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The Guard section advertises real-time file, network, and process interception without an explicit warning about privacy, system stability, or the scope of monitoring. Because these are powerful surveillance and control features, unclear disclosure can lead to covert monitoring behavior, accidental blocking of legitimate activity, or unsafe deployment on sensitive systems.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.