Security audit

赛博朋克主题

Security checks across malware telemetry and agentic risk

Overview

This is a theme installer that persistently patches the OpenClaw UI, but the behavior is mostly disclosed, scoped to visual/UI customization, and includes backups and asset hash checks.

Install this only if you are comfortable with a theme that patches your live OpenClaw control-ui index.html and runs UI JavaScript in that app. Review the target workspace and dist directory before running it, use --skip-apply if you only want files copied first, and keep the generated backups in case you want to restore the previous UI.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises installation and repair behavior but the metadata shown here does not declare the powerful capabilities it relies on, including file writes, shell execution, environment access, and network access. Missing permission disclosure weakens informed consent and review, making it easier for a user or platform to approve a skill that can modify local workspaces and fetch remote content.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This is more than a passive theme pack: the description frames it as visual customization, but the documented behavior includes persistent script injection into the live app, DOM mutation observers, runtime UI rewriting, session-navigation fallback logic, quota/auth status querying, and message timeline reordering. That mismatch is dangerous because users may consent to a cosmetic theme without realizing it installs active code into the client that can alter navigation, interface state, and message presentation.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The installer can fetch a remote ZIP bundle from ClawHub when local assets are missing, which expands a local theme installer into network-capable code. Although individual decoded assets are hash-verified, the network fetch still introduces supply-chain and privacy risk, and it is not strictly necessary for the advertised theme-install function.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The documentation states that installation immediately applies the theme and may download assets, but it does not clearly warn that local workspace files will be modified and that outbound network requests may occur. This is primarily a transparency and safety issue: users may run the command expecting only local cosmetic changes while the installer changes live application files and contacts a remote source.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The default prompt activates on broad requests to install, repair, import, or swap theme assets without clearly limiting scope, permissions, or affected files. In an agent setting, this can cause over-triggering on loosely related user requests and increase the chance of unintended modifications to workspace content or visual assets.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.