ClawHub

Cloudflare Access VPS

Security checks across malware telemetry and agentic risk

Overview

This appears to be a coherent Cloudflare Zero Trust guidance skill, with security-sensitive troubleshooting advice that users should apply carefully.

Install only if you are comfortable managing Cloudflare Access. Treat rollback and localhost bypass steps as temporary troubleshooting actions, keep the OpenClaw service bound to loopback unless intentionally exposed, and prefer scoped, expiring, rotated service tokens over shared non-expiring credentials.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The guidance explicitly tells users how to bypass Cloudflare Access by connecting directly to localhost, but it does so without a nearby warning that this removes the identity gate and should only be used on the VPS or in tightly controlled development contexts. In a skill whose purpose is to add Zero Trust protection, normalizing a direct unauthenticated network path can lead to accidental exposure or operator misunderstanding if the pattern is copied beyond local-only use.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The rollback section provides direct instructions to disable or delete Cloudflare Access and notes that traffic will continue without any authentication check at the Cloudflare layer, but it lacks a strong warning about the resulting reduction in protection. Because this skill secures an internet-facing agent, these steps could be followed during troubleshooting and leave the service exposed with only downstream auth controls, increasing the chance of unintended public access.

Session Persistence

Medium
Category
Rogue Agent
Content
## Creating a Service Token

1. **Zero Trust → Access → Service Auth → Service Tokens → Create Service Token**
2. Name it descriptively: `OpenClaw CLI - Charles laptop`, `iOS App - Koda`
3. Set **Token Duration**: `Non-expiring` for permanent apps, or a date for time-limited access
4. Copy **both** values immediately — the secret is only shown once
Confidence
92% confidence
Finding
Create Service Token** 2. Name it descriptively: `OpenClaw CLI - Charles laptop`, `iOS App - Koda` 3. Set **Token Duration**: `Non-expiring` for permanent apps, or a date for time-limited access 4. Co

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal