ClawHub
Back to skill

Security audit

agent creator

Security checks across malware telemetry and agentic risk

Overview

The skill is not clearly malicious, but it can create and register new agents, persist learned patterns, and bypass review gates if an auto-confirm setting is enabled.

Install only if you are comfortable granting it write access to your OpenClaw workspace and TEAM.md. Keep OPENCLAWS_AUTO_CONFIRM unset, review generated files before deployment, and require any memory, failure-pattern, or update behavior to be visible, opt-in, and easy to clear.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill repeatedly promises that no writes occur outside the staging area before explicit user confirmation, but later states that failure cases are stored in a separate library and success patterns are written into MEMORY.md on an ongoing basis. That creates a policy/implementation contradiction: even if deployment is paused, the agent may still persist data elsewhere, violating the claimed isolation boundary and potentially storing sensitive user-derived content without consent.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The document says user confirmation cannot be bypassed, yet also introduces OPENCLAWS_AUTO_CONFIRM=true as an override. In a skill whose main sensitive action is moving generated content into the main workspace, a hidden environment-variable bypass undermines the safety control and enables unattended writes that contradict the stated review-and-pause model.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The extension-file generation logic relies on very broad keyword matching to decide which files to create. In an agent-building context, this can cause over-generation of capabilities or policy files that were not actually intended by the user, expanding the agent's behavior surface and increasing the chance of misconfiguration, unsafe tool enablement, or scope creep.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The listed example trigger words are highly generic and overlap with normal role descriptions, making accidental activation likely across many unrelated agents. Because some triggered files govern external tools, decision authority, risk handling, or automated tasks, this broad matching can silently inject unnecessary operational instructions and increase downstream security exposure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.