Security audit

Sport Mode

Security checks across malware telemetry and agentic risk

Overview

This skill openly changes OpenClaw's heartbeat behavior, but it also encourages unattended command-running from a persistent task file and overwrites or clears workspace state without safeguards.

Review this before installing if you rely on HEARTBEAT.md or want every command approved interactively. Back up existing HEARTBEAT.md content, use only trusted task text, include a clear stop condition, and disable Sport Mode when the monitored task is finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The README expands a heartbeat/monitoring skill into autonomous operational control, explicitly describing the agent as verifying tests, committing code, and starting the next phase. That materially broadens the effective capability of the skill from observation to action, increasing the chance that users enable unattended changes or execution they did not intend.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The README instructs agents to execute commands embedded in task content, such as `sport-mode off`, establishing a pattern where arbitrary instructions in `HEARTBEAT.md` can trigger shell execution. Because the file is meant to be repeatedly read and updated by the agent, this creates a command-injection-like control channel outside the original conversational approval path.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README states that the tool will hot-patch `openclaw.json` and create or overwrite `HEARTBEAT.md`, then later clear that file, without a prominent warning about overwriting existing contents. This can cause configuration loss or destruction of user data, especially in unattended or repeated use.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README promotes autonomous follow-on actions and self-shutdown behavior without clear safety boundaries, encouraging unattended execution loops driven by persisted instructions. In practice, this can normalize agent behavior that escalates from status checks into code changes or command execution without fresh user review.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The skill explicitly instructs the agent to modify a user config file and clear `HEARTBEAT.md`, but it does not prominently warn that this changes persistent local state and may overwrite existing task content. While the behavior appears aligned with the skill’s stated purpose, silent file/config mutation can still cause unintended data loss or surprising agent behavior if a user has existing heartbeat settings or content they expect to preserve.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script unconditionally overwrites the file referenced by HEARTBEAT_FILE using shell redirection, which destroys any existing content without prompting, backup, or validation. Because the path can be influenced by OPENCLAW_WORKSPACE and defaults to the current directory, this can cause unintended data loss in normal use, especially in active workspaces where HEARTBEAT.md may already contain important status or notes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The deactivation path truncates HEARTBEAT_FILE to empty with no confirmation, which can silently erase user data. Since the target path is derived from environment-controlled workspace state, the cleanup behavior is more dangerous than a fixed internal temp file and can lead to destructive file loss in a real project directory.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.