ClawHub
Back to skill

Security audit

Clawbridge - Find your connections

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed shortcut for running the external Clawbridge CLI, with real trust and data-sharing considerations but no artifact-backed malicious behavior.

Install this only if you trust Clawbridge as a cloud service and are comfortable running its external CLI from OpenClaw. Review the remote installer if possible, use a scoped workspace/profile, and avoid running discovery on sensitive material unless Clawbridge Vault upload and retention practices are acceptable to you.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill description says the command is a thin trigger and returns a Vault link, but it does not clearly warn users that invoking /clawbridge initiates a discovery workflow and uploads results to a remote Vault service. This creates a consent and data-handling risk because users may trigger external processing and data transfer without understanding that local context or outputs may be sent off-host.

External Script Fetching

High
Category
Supply Chain
Content
- id: "install-script"
        kind: "shell"
        label: "Install via script (recommended)"
        command: "curl -fsSL https://clawbridge.cloud/install | bash"
        bins: ["clawbridge"]
---
Confidence
98% confidence
Finding
curl -fsSL https://clawbridge.cloud/install | bash

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.