ClawHub
Back to skill

Security audit

Save

Security checks across malware telemetry and agentic risk

Overview

This skill is not malicious, but it should be reviewed because it automatically creates persistent memory and indexes workspace Markdown files, not just saved conversations.

Install only if you are comfortable with a local memory system that saves conversation summaries and indexes Markdown files in the configured OpenClaw workspace. Review the workspace path before use, avoid saving secrets or private data, and be aware that reinstall/init may overwrite the conversation log and regenerate searchable metadata on disk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)

Tainted flow: 'WORKSPACE' from os.environ.get (line 17, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
# Fallback: try grep
            print("No FTS5 matches. Trying grep fallback...")
            import subprocess
            result = subprocess.run(
                ["grep", "-rl", "-m5", query, WORKSPACE],
                capture_output=True, text=True,
                env={"HOME": os.environ.get("HOME", os.path.expanduser("~"))}
Confidence
72% confidence
Finding
result = subprocess.run( ["grep", "-rl", "-m5", query, WORKSPACE], capture_output=True, text=True, env={"HOME": os.environ.get("HOME", os.pa

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill declares no permissions while instructing the agent to use environment variables, read and write local files, and execute shell/Python commands. This under-specifies its capabilities and can mislead users or policy engines, increasing the chance that persistence and indexing actions occur without informed approval.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented purpose says the skill saves conversations, but the described behavior expands into broader workspace indexing, search, topic-map generation, and grep-based fallback over general markdown files. This mismatch matters because users may consent to saving one conversation, while the skill also enables discovery and indexing of unrelated workspace content, broadening data exposure.

Description-Behavior Mismatch

Medium
Confidence
83% confidence
Finding
The file discovery logic indexes all markdown files under the workspace plus saved conversations, which exceeds a narrow 'save conversations to memory index' purpose. In an agent skill, this capability expansion matters because it silently broadens the corpus of accessible content, increasing the chance of unintended collection and later retrieval of sensitive workspace data.

Description-Behavior Mismatch

Medium
Confidence
80% confidence
Finding
The search, tags, and topic commands add discovery and browsing features beyond the declared save/dispatch behavior. In a memory skill, these extra retrieval capabilities make the broader indexing more dangerous because they operationalize access to collected data rather than merely storing it.

Context-Inappropriate Capability

Medium
Confidence
78% confidence
Finding
Spawning grep introduces an external file-search capability not justified by the manifest's save-to-memory scope. This becomes more concerning in an agent environment because fallback behavior can search raw workspace contents outside the structured index, increasing unintended data access and reducing auditability.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrase 'save this conversation' is broad enough that normal dialogue could unintentionally invoke persistence of sensitive content. Because the action writes local files and updates a retrievable index, accidental activation creates durable data retention risk.

Vague Triggers

Medium
Confidence
92% confidence
Finding
Additional examples like 'save this' remain overly generic and lack guardrails, making accidental invocation more likely during ordinary conversation. In a persistence skill, broad natural-language triggers are especially risky because the consequence is durable storage and indexing of conversation-derived content.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill does not clearly warn users that '/save' persists conversation-derived content to local storage and indexes it for later retrieval. Without a prominent retention warning, users may not understand that summaries, filenames, and searchable artifacts will remain on disk beyond the session.

Ssd 3

Medium
Confidence
97% confidence
Finding
The skill directs the agent to persist conversation-derived data and make it searchable based on a broad 'save' trigger, which creates a real data-retention and later-disclosure risk. Even if the summary is not verbatim chat, it can still contain secrets, internal decisions, or sensitive personal data that become discoverable through the index.

Unvalidated Output Injection

High
Category
Output Handling
Content
# Fallback: try grep
            print("No FTS5 matches. Trying grep fallback...")
            import subprocess
            result = subprocess.run(
                ["grep", "-rl", "-m5", query, WORKSPACE],
                capture_output=True, text=True,
                env={"HOME": os.environ.get("HOME", os.path.expanduser("~"))}
Confidence
69% confidence
Finding
subprocess.run( ["grep", "-rl", "-m5", query, WORKSPACE], capture_output

Session Persistence

Medium
Category
Rogue Agent
Content
install:
      - id: setup
        kind: setup
        label: "Create saved conversations directory"
        run: "mkdir -p ~/.openclaw/workspace/saved"
      - id: init-log
        kind: init
Confidence
89% confidence
Finding
Create saved conversations directory" run: "mkdir -p ~/.openclaw/workspace/saved" - id: init-log kind: init label: "Initialize conversation log" run: "echo -e '#

Session Persistence

Medium
Category
Rogue Agent
Content
#    - Python 3.8+ (stdlib only — no pip packages needed)
#    - An OpenClaw agent with write/edit/exec/read tools

# 1. Create the saved conversations directory (inside the workspace)
mkdir -p ~/.openclaw/workspace/saved

# 2. Initialize the conversation log
Confidence
88% confidence
Finding
Create the saved conversations directory (inside the workspace) mkdir -p ~/.openclaw/workspace/saved # 2. Initialize the conversation log echo -e '# Conversation Log\n_0 conversations_\n' > ~/.opencl

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.