Agent Deployment

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:37 PM UTC
• Version:
  1.0.0

Overview

This is a coherent instruction-only deployment skill for setting up OpenClaw, with ordinary setup risks that users should handle carefully.

Before installing, inspect the remote nvm install script, confirm the OpenClaw npm package is the expected one, keep gateway tokens private, leave the gateway bound to localhost unless you intentionally secure remote access, and avoid putting secrets or sensitive personal data in USER.md or other workspace markdown files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs users to start a local gateway and references a token, but it does not warn users to keep the token secret, limit binding to localhost, or avoid exposing the service to other hosts. In a deployment skill, omission of these safeguards can lead to accidental credential leakage or unauthorized access to the agent gateway.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: The workspace initialization instructs users to record personal information and preferences in USER.md without any privacy or data-minimization warning. This can cause operators to store sensitive personal data in plaintext workspaces that may later be synced, shared, or exposed to other agents.

VirusTotal

57/57 vendors flagged this skill as clean.