ClawHub
Back to skill

Security audit

Threat Radar

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a security-scanning skill, but it materially overstates its CVE and SSL capabilities and under-discloses some sensitive workspace and network behavior.

Review before installing. The skill does not show exfiltration or destructive behavior, but do not rely on it as a real vulnerability scanner without fixing the mock CVE feed and SSL validation. Be aware it can scan workspace dependency files, Docker image names, OpenClaw config, and credential-file metadata, and confirm any alerting or network behavior before use in a sensitive environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises alerting through third-party messaging services but does not prominently warn that potentially sensitive vulnerability findings may leave the local environment. Security scan results can reveal internal hostnames, exposed services, package versions, and remediation state, which are valuable to attackers if leaked or shared to insecure channels. Because this is a security product, users are likely to trust it with sensitive environment data, making omission of a clear warning more dangerous.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation states 'No external services required' while the skill later describes downloading CVE data from NVD and GitHub Advisories. This is a security-relevant misrepresentation because operators may enable the skill in restricted or privacy-sensitive environments under the false assumption that it is fully local. The mismatch can lead to unintended outbound network access and weakened trust in the skill's stated security properties.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
[OPENCLAW CONFIG] ────────────────────────────────────────
  agentToAgent permissions      ✓ Restricted (not [*])
  Credential file permissions   ✓ 600 (not world-readable)
  Memory file permissions       ✓ 600
  Gateway auth enabled          ✓ Yes
  Sandbox restrictions          ⚠ exec-sandbox: false (accepted risk)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The privacy note claims no data is sent externally except NVD API calls, but the skill also references GitHub Advisories and alerting via WhatsApp/Telegram/Discord. That inconsistency can cause users to underestimate data disclosure, especially if security findings, hostnames, or software inventory are transmitted to third-party messaging platforms. In a security-monitoring skill, incomplete disclosure of data egress is particularly risky because the outputs are themselves sensitive.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The function claims to fetch current CVE data from NVD and GitHub but only writes a small hardcoded mock dataset. This can create a dangerous false sense of security, causing users to rely on incomplete and stale vulnerability coverage while believing they are receiving real-time threat intelligence.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · threat_radar.py (reported line 239)May include surrounding context.

python
self._load_cve_cache()

        try:
            result = subprocess.run(
                ["docker", "images", "--format", "{{.Repository}}:{{.Tag}} {{.ID}}"],
                capture_output=True,
                text=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The SSL scan initiates outbound connections to configured domains without a prominent disclosure beyond generic scan messaging. In security tooling embedded as a skill, undeclared network access is risky because it can leak infrastructure targets and run afoul of sandbox, privacy, or policy expectations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

The openssl s_client call is not shell-invoked, so command injection risk is low, but it does make outbound network connections to domains from configuration with no explicit consent or strong validation. In an agent skill context, undisclosed external connectivity can leak operational metadata and trigger network side effects in restricted environments.

Content

Scanner excerpt · threat_radar.py (reported line 370)May include surrounding context.

python
for domain in domains:
            try:
                # Check cert validity (simplified)
                result = subprocess.run(
                    ["openssl", "s_client", "-connect", f"{domain}:443", "-servername", domain],
                    input=b"QUIT\n",
                    capture_output=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The scan traverses .credentials metadata and reads workspace configuration without a specific warning or consent boundary. In an agent-skill environment, silent inspection of sensitive directories can violate user expectations and expose secret filenames, paths, and permission-state information in logs or output.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
78% confidence
Finding

The code identifies that credential files may be group/world-readable, which is a real insecure-defaults condition if present in the workspace. In this skill’s context, credential exposure is especially sensitive because the workspace appears to contain agent and integration secrets, so overly broad file permissions could enable local secret disclosure.

Content

Scanner excerpt · threat_radar.py (reported line 426)May include surrounding context.

python
if stat_info.st_mode & 0o077:  # World or group readable
                        findings.append(
                            {
                                "issue": f"Credential file {cred_file.name} is world-readable",
                                "severity": "Critical",
                                "fix": f"chmod 600 {cred_file}",
                            }

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · threat_radar.py (reported line 428)May include surrounding context.

python
{
                                "issue": f"Credential file {cred_file.name} is world-readable",
                                "severity": "Critical",
                                "fix": f"chmod 600 {cred_file}",
                            }
                        )

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The SSL scan claims to check certificate validity, but it only treats a successful openssl s_client connection as valid=True and assigns a hardcoded grade A. This can misclassify expired, mismatched, self-signed, or otherwise invalid certificates as safe, misleading users about transport security.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.