OpenClaw Performance

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:34 PM UTC
• Version:
  1.1.0

Overview

This is a local performance-analysis skill that reads user-selected source files and does not show evidence of network transfer, credential use, persistence, or destructive behavior.

Install only if you are comfortable letting the tool read the source files or directories you pass to it. Prefer running it on explicit project paths, and be careful with any profiling or benchmarking commands that would execute untrusted code.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly instructs users to analyze files and directories (for example `--file` and `--dir` inputs), which implies file-reading capability, but the documentation does not declare permissions. Undeclared file access weakens reviewability and consent boundaries, making it easier for a skill to read unintended local source files during analysis.

VirusTotal

66/66 vendors flagged this skill as clean.