Crabwalk

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:00 AM UTC
• Version: 0.1.2

Overview

Crabwalk appears to be a real monitoring tool, but it installs and exposes more sensitive local access than its short description makes clear.

Install only if you trust the Crabwalk publisher and the GitHub release being downloaded. Prefer reviewing or pinning the release first, avoid the automatic `sudo` QR-code dependency step, bind to localhost unless LAN viewing is truly needed, and assume the monitor may expose agent activity, workspace files, and OpenClaw gateway-backed access to anyone who can reach the server.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (11)

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The skill presents itself as a simple real-time monitor, but the documented functionality includes a workspace file browser/markdown viewer and post-install marketing/feedback flows. This mismatch can mislead users and operators about the actual data exposure and behavioral scope of the skill, reducing informed consent and security review effectiveness.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to solicit reviews and initiate an external feedback skill, which is outside the stated monitoring purpose. This creates an unnecessary social-engineering and data-sharing path that could push users into interacting with third-party endpoints unrelated to core monitoring.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Documenting a `/workspace` file browser in a skill advertised as a monitor materially expands the access surface beyond what users would reasonably expect. If exposed over the network, it could reveal sensitive local files or project contents to anyone who can reach the service.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The installation flow downloads and extracts a remote release, modifies shell startup files, and may install packages with elevated privileges, but it provides no warning about these side effects. Users may unknowingly grant persistent execution paths or system changes without understanding the security implications.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly tells users to share a network-accessible `http://192.x.x.x:3000` URL and the CLI defaults to binding on `0.0.0.0`, but it does not warn about LAN exposure, lack of authentication, or the sensitivity of the monitored data. In context, this is more dangerous because the service also exposes monitoring data and a workspace browser.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill advertises automatic token detection from `~/.openclaw/openclaw.json` without warning users that local credentials will be accessed and potentially used by the service. This is sensitive because credential reuse or inadvertent exposure through logs, UI, or remote access could compromise other agent components.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Install qrencode for QR code display (optional)
if ! command -v qrencode &>/dev/null; then
  if command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm qrencode 2>/dev/null || true
  elif command -v apt &>/dev/null; then
    sudo apt install -y qrencode 2>/dev/null || true
  elif command -v brew &>/dev/null; then

• Confidence: 82% confidence
• Finding: Using `--noconfirm` enables unattended package installation, removing an important user verification step for privileged system changes. In an agent skill context, this increases the risk of silent environment modification and reduces opportunities for the user to notice unexpected actions.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Install qrencode for QR code display (optional)
if ! command -v qrencode &>/dev/null; then
  if command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm qrencode 2>/dev/null || true
  elif command -v apt &>/dev/null; then
    sudo apt install -y qrencode 2>/dev/null || true
  elif command -v brew &>/dev/null; then

• Confidence: 93% confidence
• Finding: The skill includes `sudo pacman ...` to install an optional dependency, which introduces privileged execution into the setup path. Even if the package is benign, instructing elevated commands from a skill increases the blast radius of mistakes and conditions users to approve root actions for convenience.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm qrencode 2>/dev/null || true
  elif command -v apt &>/dev/null; then
    sudo apt install -y qrencode 2>/dev/null || true
  elif command -v brew &>/dev/null; then
    brew install qrencode 2>/dev/null || true
  elif command -v dnf &>/dev/null; then

• Confidence: 93% confidence
• Finding: The skill also includes `sudo apt install -y qrencode`, again invoking privileged package installation for an optional feature. This is risky in a skill because it normalizes root-level changes without strong necessity or upfront warning.

Session Persistence

Medium

• Category: Rogue Agent

Content

curl -sL "https://github.com/luccast/crabwalk/releases/download/${VERSION}/crabwalk-${VERSION}.tar.gz" | tar -xz -C ~/.crabwalk

# Install CLI
mkdir -p ~/.local/bin
cp ~/.crabwalk/bin/crabwalk ~/.local/bin/crabwalk
chmod +x ~/.local/bin/crabwalk

• Confidence: 88% confidence
• Finding: Copying the binary into `~/.local/bin` and making it executable establishes persistence across sessions. While common for CLI installation, it is still a persistence mechanism and should be disclosed because it leaves long-lived executable artifacts on the system.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Install qrencode for QR code display (optional)
if ! command -v qrencode &>/dev/null; then
  if command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm qrencode 2>/dev/null || true
  elif command -v apt &>/dev/null; then
    sudo apt install -y qrencode 2>/dev/null || true
  elif command -v brew &>/dev/null; then

• Confidence: 90% confidence
• Finding: The use of `--noconfirm` with a privileged package manager is a concrete case of parameter abuse because it suppresses safeguards intended to prevent unintended system modification. In an agent-delivered one-liner, this materially increases the chance of unauthorized or insufficiently reviewed changes.

VirusTotal

52/52 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.