ClawHub

ClawCheck

Security checks across malware telemetry and agentic risk

Overview

ClawCheck is a local OpenClaw audit tool that inspects configuration and workspace files for health and security issues without evidence of network exfiltration, persistence, or destructive behavior.

Install this only when you want an agent to inspect local OpenClaw configuration, cron prompts, skills, and workspace files for audit findings. Keep the generated JSON/report local or review it before sharing, because it may reveal file paths and locations of suspected credentials.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The script recursively reads files in the workspace and emits relative file paths when suspected secrets are detected, but provides no up-front notice or consent boundary to the operator. In shared, logged, or automated environments, this can expose sensitive project structure and indicate where secrets reside, increasing disclosure risk even though the tool is intended for defensive auditing.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal