ClawHub
Back to skill

Security audit

Model Advisor

Security checks across malware telemetry and agentic risk

Overview

This skill is a local model-advice helper that reads recent OpenClaw sessions and configuration as disclosed, with no evidence of network transfer, file mutation, or persistence.

Install only if you are comfortable with a local Node script reading recent OpenClaw session messages and OpenClaw configuration. Use the recommend mode with a specific task if you do not want history inspected, and avoid sharing the security report publicly because it can reveal gateway posture such as bind mode, auth mode, and port.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The manifest uses very broad trigger phrases such as '用哪个模型', '推荐模型', '适合什么模型', and '根据历史', which can match ordinary conversation unrelated to this skill’s intended scope. Because the skill can read recent session history and local configuration, over-triggering increases the chance of unintended invocation and unnecessary access to sensitive contextual data.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The description does not clearly disclose that the auto mode reads the user's recent 5 sessions to infer task types. This creates a transparency and privacy problem: users may trigger the skill expecting a simple recommendation, while the skill silently analyzes historical conversations that may contain sensitive information.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The auto/history-analysis feature reads prior user session files from ~/.openclaw/.../sessions and uses their contents to drive recommendations without any explicit consent prompt, warning, or scope restriction. Even if the text is not fully dumped verbatim, the tool processes sensitive historical prompts and surfaces derived insights such as keywords and task patterns, creating a real privacy boundary violation.

Ssd 3

Medium
Confidence
95% confidence
Finding
The history analysis logic ingests raw user message text from session .jsonl files and then summarizes behavioral patterns in plain-language output such as top keywords and recommended model type. This lacks clear minimization and consent boundaries, so a user invoking the skill for recommendation may unknowingly trigger analysis of unrelated past conversations that could contain confidential prompts, secrets, or personal data.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.