Build an Agent with Warden

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:01 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Warden/LangGraph agent-building guide with expected scaffolding, testing, deployment, API-key, and external-service examples, not hidden or deceptive behavior.

Install only if you intend to build or deploy Warden/LangGraph agents. Run the scripts in a project directory you control, review generated files before deploying, keep real API keys out of Git and logs, replace example database passwords, and avoid sending sensitive wallet, portfolio, or personal data to third-party APIs unless users understand and consent to that flow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the user to run shell commands, create files such as .env, install dependencies, clone repositories, build Docker images, and interact with external network resources, but it does not declare any permissions despite clearly requiring env, file_write, network, and shell capabilities. In an agent execution environment, this mismatch can bypass operator expectations and safety controls, increasing the risk of unintended code execution, secret handling, or filesystem/network side effects.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill advertises broad natural-language triggers such as 'LangGraph agent' and 'Deploy to Warden', which can cause the skill to activate in contexts that are only loosely related to Warden-specific agent building. Over-broad invocation increases the chance that an agent follows this skill's workflow, scripts, or external links when another skill or a safer default behavior would have been more appropriate.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The statement that OpenClaw will 'automatically detect the skill' and trigger it when users mention Warden or LangGraph agents is vague and unconstrained. In a multi-skill environment, this can lead to unintended selection of this skill for generic LangGraph requests, pulling the agent into a deployment- and code-generation-oriented workflow with external dependencies and operational consequences.

Vague Triggers

Low

• Confidence: 84% confidence
• Finding: The invocation criteria are broad enough to trigger on many requests involving building, deploying, or integrating crypto/Web3 agents, but they do not clearly state exclusions for situations where executing commands, writing files, or handling secrets should be disallowed or require confirmation. This can cause over-invocation of a high-capability skill, making risky operations such as repository cloning, dependency installation, deployment setup, and API key handling more likely to occur in contexts where they were not intended.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The PostgreSQL Docker Compose example uses default credentials (postgres/postgres) and does not warn that they are only acceptable for isolated local development. If copied into shared, exposed, or production-like environments, attackers could easily authenticate to the database and access or modify stored data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The structured logging example includes `logger.debug('Processing request', { input });`, which encourages logging raw user-supplied input. In an agent deployment context, inputs may contain secrets, wallet data, prompts, personal data, or other sensitive content, and those logs may be persisted to console and files, increasing exposure during incidents or routine log access.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The guide says the skill should trigger on broad terms like 'Warden', 'LangGraph agent', and 'Warden Studio' without defining exclusion conditions or requiring stronger intent signals. In an agentic system, overbroad trigger rules can cause unintended invocation, pulling in this skill's instructions and scripts in contexts where the user did not request them, which increases the attack surface for mis-scoped automation and prompt-routing mistakes.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The automatic triggering section includes ambiguous keywords and template names that may match informational or unrelated requests, causing the skill to activate when not appropriate. Because this skill is designed to guide code generation, deployment, and possible script execution, accidental activation in a broader assistant environment can lead to incorrect tool use, unnecessary context loading, or unsafe workflow escalation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This documentation repeatedly demonstrates sending user input and derived analysis to third-party LLM and API services without any warning, consent guidance, or data-minimization advice. In an agent-builder skill, users may copy these patterns directly into production and unintentionally transmit sensitive prompts, wallet-related context, or trading data off-platform.

External Transmission

Medium

• Category: Data Exfiltration

Content

try {
    const { token } = state.extractedParams;
    const response = await fetch(
      `https://api.coingecko.com/api/v3/coins/${token}`
    );
    const data = await response.json();

• Confidence: 87% confidence
• Finding: https://api.coingecko.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

const results = await Promise.all(
    state.items.map(async (item) => {
      try {
        const response = await fetch(`https://api.example.com/${item}`);
        const data = await response.json();
        return { item, data };
      } catch (error) {

• Confidence: 84% confidence
• Finding: https://api.example.com/

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.