ClawHub
Back to skill

Security audit

task-progress-stream

Security checks across malware telemetry and agentic risk

Overview

This skill openly runs or monitors long-running local jobs and streams progress into OpenClaw chat, so it is useful but should only be used with trusted commands and logs.

Install this only if you intentionally want OpenClaw to launch or monitor long-running local jobs. Review the exact command and working directory before using run mode, prefer tail mode when you only need to watch an existing log, and avoid streaming logs that may contain API keys, credentials, private data, or sensitive prompts. Clean up generated status and log files when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The script's documented purpose is to stream task progress, but in run mode it also executes an arbitrary shell command supplied via --cmd using /bin/bash -lc. That gives the caller full shell execution capability, which is broader than a passive progress-streaming skill and can be abused for arbitrary code execution, data access, and persistence if exposed to untrusted input or broader agent workflows.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The subprocess launch is unrestricted and accepts arbitrary commands, then executes them in a shell with the caller-controlled working directory. In an agent skill context, this is especially dangerous because a seemingly harmless progress utility becomes a generic command runner, increasing the blast radius of prompt injection, parameter tampering, or misuse by downstream automation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill description does not warn that command output and tailed log contents will be injected into the chat UI, which can expose secrets, credentials, proprietary data, or prompt-injection content contained in logs. In this context, streaming untrusted stdout/stderr into chat increases risk because the UI becomes a conduit for sensitive data leakage and potentially adversarial text.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/task_progress_stream.js:255