ClawHub
Back to skill

Security audit

skill-usage

Security checks across malware telemetry and agentic risk

Overview

This skill transparently sets up a usage-analytics plugin, with disclosed install, restart, and optional cloud-sync behavior.

Install this only if you trust the third-party plugin package and are comfortable restarting the OpenClaw Gateway. Keep analytics local unless you explicitly want shared leaderboards, because even usage metadata like skill names, channel labels, agent labels, timestamps, and routing identifiers may reveal operational patterns.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Low
Confidence
88% confidence
Finding
The trigger phrase "show which skills are used most" is broad and can match a normal analytics/query intent rather than explicit setup intent. In this skill, invoking it would lead to package installation and gateway restart, which are higher-impact actions than the user may have intended, so the overbroad trigger creates a real misfire risk even though the surrounding documentation includes consent guidance.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.