Back to skill

Security audit

Skill Perf

Security checks across malware telemetry and agentic risk

Overview

This is a real benchmarking skill, but it reads detailed local agent session data and automatically serves generated reports in ways users should review before installing.

Install only if you are comfortable with a benchmarking tool that runs target skills for real, consumes tokens, reads detailed local OpenClaw session and transcript artifacts, stores reports/results under ~/.openclaw, and starts a local report server. Use harmless test tasks, avoid secrets or customer data in benchmark prompts, and do not benchmark destructive or account-changing skills without separate safeguards.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
url = f"http://localhost:{port}/{filename}"

    # 后台启动 python -m http.server,30 秒后自动退出
    subprocess.Popen(
        ["python3", "-m", "http.server", str(port), "--directory", serve_dir],
        stdout=subprocess.DEVNULL,
        stderr=subprocess.DEVNULL,
Confidence
89% confidence
Finding
subprocess.Popen( ["python3", "-m", "http.server", str(port), "--directory", serve_dir], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, )

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares no permissions, yet its documented behavior requires broad capabilities including shell, file read/write, network, and session orchestration. This creates a transparency and consent failure: users and policy systems cannot accurately assess what the skill may access or execute, increasing the chance of unintended data exposure or command execution in a powerful local agent environment.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as a simple token/performance measurement helper, but the documented behavior extends to persistent calibration state, direct local OpenClaw HTTP API interaction, filesystem/session scraping, standalone CLI utilities, and launching a local HTTP server. This mismatch is dangerous because it conceals materially broader attack surface and data access than users would reasonably expect from the description, enabling over-collection of local state and unintended exposure of generated reports.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
This section reads and exposes detailed session metadata, registered skills, model/provider details, context window usage, bootstrap files, and system prompt composition. For a skill whose stated purpose is token/performance measurement, collecting and reporting these internals is excessive and creates unnecessary disclosure of sensitive prompt and agent configuration data.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The script parses full subagent transcript JSONL files and extracts per-step hints about tool usage, commands, file names, URLs, and other execution details. This greatly exceeds a benchmarking function and can leak sensitive operational data, prompts, paths, and command history from unrelated agent activity into reports.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
Starting a local HTTP server is an additional capability not justified by the manifest's stated purpose of token/performance measurement. Combined with the rich report contents, it creates an avoidable exposure channel for sensitive diagnostic data and broadens the attack surface of the skill.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The README states the skill should trigger whenever the user mentions broad concepts like measurement, testing, performance, cost, efficiency, comparison, or optimization, even if the user never explicitly names this skill. That broad routing guidance can cause unintended invocation in unrelated contexts, increasing the chance the agent spawns subagents and reads session artifacts without sufficiently specific user intent or scope control.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger language is extremely broad, covering common terms like measurement, testing, performance, cost, efficiency, and optimization, and instructs the agent to invoke the skill even when the user did not name it. In a high-privilege environment, over-broad auto-triggering can cause the skill to run unexpectedly, spawning subagents and accessing local/session resources when the user may have intended only a general discussion.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script persists benchmark summaries to disk and includes the full task content, which may contain secrets, internal URLs, customer data, or sensitive prompts. In this skill context, tasks are explicitly sent to agents for testing and may realistically include proprietary or confidential material, so silent local retention increases the risk of unintended disclosure via local compromise, backups, logs, or shared workstations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.