Skillv0.1.0

ClawScan security

Macarena Test · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousFeb 10, 2026, 4:25 PM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill's instructions broadly match a gateway audit, but it asks the agent to execute a local collection script immediately (no consent) and to read many local reference/config files while allowing the model to invoke it—this combination is disproportionate and risky.
Guidance: This skill looks like a legitimate audit tool, but it instructs the agent to execute a local collection script immediately and to read many local files. Before installing or running it: 1) Inspect scripts/collect_verified.sh and all references/* files yourself — do not run them until you review their contents. 2) Run the collection script in a safe environment (non-root account, container, or isolated VM) and backup any important data. 3) Require explicit user consent before the agent runs any local scripts; consider setting disableModelInvocation or requiring the user to invoke the skill manually. 4) If you proceed, verify that verified-bundle.json and reference files come from a trusted source and redact or exclude any secrets. 5) Prefer running the audit offline and only share redacted evidence after manual review.

Review Dimensions

Purpose & Capability: noteThe declared goal—auditing an OpenClaw gateway—matches the requested actions (run a collection script, read a verified bundle and many reference files). There are no unrelated environment variables or external installs, so capabilities are generally aligned with the stated purpose.
Instruction Scope: concernThe SKILL.md requires immediate execution of scripts/collect_verified.sh 'immediately (no consent prompt)' and mandates reading many local reference/config files. Running an arbitrary local script without an explicit user consent or an upfront inspection is intrusive and can access sensitive files. Although the skill forbids exfiltration, the instructions do not provide safeguards to prevent the agent from reading or leaking secrets present in the collected data.
Install Mechanism: okInstruction-only skill with no install spec and no code files. This minimizes supply-chain risk because nothing is downloaded or written to disk by the installer.
Credentials: concernThe skill declares no required environment variables or credentials, which seems reasonable. However, its runtime instructions require reading configuration, state files, and a collected bundle that may contain secrets or credential material. There is a mismatch between 'no creds required' and the broad filesystem/config access the audit implicitly requests—this increases risk if those files contain sensitive data.
Persistence & Privilege: concernThe skill is model-invocable by default (disableModelInvocation not set) and not flagged always:false; combined with the SKILL.md instruction to run a local script immediately, this creates a risk that the model could autonomously execute local collection without explicit, auditable user consent. The skill should require explicit user confirmation before running any local executable and consider disabling autonomous invocation for high-sensitivity actions.