Low-Spec Optimizer

• Outcome: Review
• Latest audit: May 29, 2026 at 9:24 PM UTC
• Version:
  1.0.0

Overview

This skill has a legitimate low-resource maintenance purpose, but its cleanup script can delete broader local and system state than users may expect.

Review before installing if this will run on a shared or important machine. Use the resource checker freely, run cleanup only with --dry-run first, avoid --aggressive unless you explicitly want npm, pip, and journal cleanup, and fix the hard-coded /home/nvi paths plus the stale-session find command before trusting it with important OpenClaw session history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The aggressive mode deletes global npm and pip caches and vacuums system journal logs, which affects shared system state beyond OpenClaw-specific artifacts. In a low-resource optimization skill, this broad cleanup can remove forensic data, disrupt other users or applications, and cause unexpected side effects on multi-purpose or shared hosts.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The manifest description authorizes proactive activation during generic "heartbeats to check system health" and "before spawning multiple subagents," which is broader than a tightly scoped user-triggered optimization workflow. This can cause the skill to run in situations not explicitly requested by the user, increasing the chance of unnecessary monitoring, cleanup actions, or behavioral changes on the host system.

VirusTotal

66/66 vendors flagged this skill as clean.