ClawHub
Back to skill

Security audit

Agent Profile Images

Security checks across malware telemetry and agentic risk

Overview

This profile-image skill is not clearly malicious, but it bundles broad control-panel source snapshots that can affect much more than avatars.

Review and apply this only as a narrow diff against your exact OpenClaw version. Keep the avatar upload/generation changes if desired, but do not blindly copy the full reference snapshots into a live control UI without checking the unrelated admin, file, credential, and wizard code paths.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The skill is presented as an avatar/profile-image feature, but the exposed handlers also create, update, delete, and modify agent workspaces and files. This scope expansion violates least privilege and increases the blast radius: any caller granted this skill can perform destructive or persistence-affecting operations far beyond image management.

Context-Inappropriate Capability

High
Confidence
94% confidence
Finding
The profile-image skill contains an AI wizard that contacts external LLM APIs and generates agent names, emoji, and SOUL.md content, which is unrelated to avatar handling. This hidden capability broadens data exposure and operational power, making the skill materially more dangerous than advertised and enabling unintended outbound transmission of user-provided descriptions.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly states that uploaded avatars are saved under the agent workspace and persisted via IDENTITY.md, but it does not clearly warn users about that persistence in a user-facing way. This can lead to unintended long-term storage of personal or sensitive images, surprising users and increasing privacy and data-retention risk, especially in a UI feature centered on image upload.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
Avatar generation sends agent metadata and optional user-supplied instructions to OpenAI, but this code path provides no visible consent, warning, or data-minimization control. In a profile-image skill, outbound transfer of identity/theme data may be unexpected, creating privacy and compliance risk if users assume processing is local.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The wizard transmits free-form user descriptions to external model providers without any notice or consent in this server path. Because descriptions may contain sensitive operational or personal details, silent forwarding to third parties creates a meaningful privacy and governance risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.