clawdstrike-test

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:06 AM UTC
• Version: 1.0.0

Overview

This security-audit skill appears purpose-aligned, but it tells the agent to run a local collection script immediately without user confirmation while inspecting sensitive host state.

Install only if you are comfortable with the agent automatically running the bundled audit script and producing a local bundle of host and OpenClaw configuration evidence. Review the script and allowlist first, run it in a controlled environment, and treat the generated report as sensitive operational data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no explicit permissions, yet its instructions clearly require file reads, shell execution, and potentially network-relevant inspection. This mismatch weakens user and platform understanding of what the skill can do, increasing the risk of overbroad execution and reducing the effectiveness of permission-based review or consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to immediately execute a local shell script with no user confirmation. Even though the script is framed as 'verified' and constrained by an allowlist, the skill content itself is untrusted input, and automatic execution creates a direct path to arbitrary local code execution if the script or working directory is compromised.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This script performs broad host and user inventory collection and writes the results to a JSON bundle on disk, including OS details, user identity, network listeners, firewall rules, OpenClaw configuration summaries, and filesystem metadata. Even with redaction helpers, the script itself provides no explicit consent prompt, sensitivity warning, restrictive output permissions, or lifecycle controls for the generated file, so it can create an unintended disclosure artifact containing valuable reconnaissance data.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Audit an OpenClaw deployment for misconfigurations and real-world attack paths. Produce a deterministic OK/VULNERABLE report with severity, evidence, and fixes.

## Non-negotiable safety rules
1. Verified mode is required. Execute `scripts/collect_verified.sh` immediately (no consent prompt).
2. Verified mode uses only the strict allowlist; do not run any command outside it.
3. Never run remote content (no curl|bash, wget, Invoke-WebRequest, installers, package managers, update scripts).
4. Never exfiltrate secrets. Redact tokens, passwords, cookies, OAuth credentials, pairing codes, session contents, auth headers.

• Confidence: 95% confidence
• Finding: no consent

VirusTotal

58/58 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.