ClawHub
Back to skill

Security audit

Docker官网镜像拉取能力

Security checks across malware telemetry and agentic risk

Overview

The skill appears to perform its Docker image mirror function, but it asks the agent to handle live GitHub/CNB credentials and installs persistent GitHub automation, so it needs user review before use.

Review before installing. Prefer gh auth login and do not paste GitHub PATs or CNB tokens into chat; enter secrets locally or through provider-managed secret flows where possible. If you use it, create the narrowest possible tokens, confirm the target GitHub repository and workflow contents, protect ~/.openclaw/.env, and remove the repository secrets/workflow when the mirror is no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill explicitly instructs the user to send a live CNB access token back to the agent in chat. Chat channels are typically broader in scope than a local secret store and may be logged, retained, or exposed to other components, so this creates unnecessary credential disclosure risk. The surrounding text normalizes this behavior instead of warning against it, which makes the issue more dangerous in practice.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script transmits sensitive credentials to external systems without a prominent user-facing consent step immediately before use. In this region it logs into the registry with CNB_TOKEN and later uses GITHUB_TOKEN in authenticated git operations, which can surprise users of an agent skill and increase the risk of unintended secret use or disclosure through process arguments, logs, or remote actions.

Ssd 3

High
Confidence
99% confidence
Finding
The skill asks for a live CNB token so the agent can store it in ~/.openclaw/.env and reuse it. That introduces direct credential handling by the agent and persistence on disk, expanding the attack surface to chat logs, local files, agent memory/context, and any downstream automation that reads the file. Because the token grants registry access, compromise could enable unauthorized image pulls or pushes depending on token scope.

Ssd 3

High
Confidence
98% confidence
Finding
Suggesting that the user provide a GitHub Personal Access Token to the agent creates a serious credential exposure path. Even though the text recommends minimal scope, the token would still traverse the agent interface and could permit repository modification, secret management, and workflow control, which are sensitive capabilities that attackers could abuse if the token leaks.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.