ClawHub
Back to skill

Security audit

openclaw-server-secure-skill

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended for legitimate server hardening, but it includes high-impact server changes that need careful review before use.

Review the SSH steps before running them: confirm a sudo-capable non-root account, tested SSH keys, an open backup session, and console recovery. Prefer a verified package-based Tailscale install or inspect the installer before execution. This does not look malicious, but it can lock you out or execute privileged remote installer code if used carelessly.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill instructs disabling password authentication and root SSH login without first requiring verification of working non-root key-based access and recovery access. In a remote-only setup, this can lock administrators out of the server and create an availability incident during hardening.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill uses `curl -fsSL https://tailscale.com/install.sh | sh`, which executes remote network content directly in a shell without integrity verification or review. If the delivery path, remote script, or TLS trust chain is compromised, this becomes arbitrary code execution as the local user, often followed by privileged operations.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.