Security audit
kkclaw
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed setup guide for an OpenClaw desktop companion; its main risks come from installing and running an external desktop app, not from hidden behavior in the submitted artifact.
Install this as you would an external desktop application: review the linked repository or release, prefer scoped and revocable API keys, confirm where configuration and logs are stored, and make sure you know how to stop or disable any resident Gateway or desktop helper behavior.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.