Security audit

Local Document Ingest

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent for knowledge-base ingestion, but it can persist raw local files from task-supplied paths into a Gitea repository without enforcing a shared-directory boundary.

Install only in an environment where the backend task payload is trusted and storagePath values are generated by OpenClaw, not by end users. Use a Gitea bot token scoped to the intended KB repo, avoid processing sensitive folders unless raw-file archival is acceptable, and prefer adding shared-directory path validation plus an updated pypdf constraint before broad deployment.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The function advertised for local-folder ingestion also pulls additional repository data via GiteaClient, specifically catalog.json and index.md, and later includes that material in the returned context. This expands data access beyond the supplied local items and can unintentionally expose workspace/repository content to downstream processing, violating least-privilege expectations for a local file reader.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The related_page_cards logic reads arbitrary matching repository pages and includes content previews in the generated context based on token overlap with uploaded files. That behavior broadens the skill from local-file preparation into cross-repository content aggregation, creating a data exposure path where unrelated repository content may be surfaced to later model stages.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill description says it ingests files into a knowledge base, but it does not clearly warn that execution will modify repository content, update indexes/catalog metadata, and archive uploaded originals under source_files. In a system that operates on user-provided local documents, incomplete disclosure can cause users or operators to authorize a task without understanding its write scope and retention behavior, increasing the risk of unintended data persistence and repository changes.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The manifest explicitly states that the skill will archive local source files and write content to a Gitea repository, but it does not provide any explicit warning that local user data may be copied, persisted, or transmitted to an external service. This creates a real security and privacy risk because operators may invoke the skill without understanding that sensitive local documents could be retained in source archives and published into a remote knowledge base.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The function reads arbitrary local file bytes from item-provided storage paths and uploads them to a remote Gitea client, which can exfiltrate sensitive local data if the item list or storagePath values are attacker-controlled. Because there is no validation that storagePath stays within an approved local staging directory and no content-type or sensitivity filtering, the skill context makes this more dangerous: this component is specifically designed to process local documents, so it operates near sensitive filesystem data by default.

Known Vulnerable Dependency: pypdf==4.3 — 10 advisory(ies): CVE-2026-48156 (pypdf: Possible long runtimes for zero-only width values in cross-reference stre); CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks); CVE-2026-27628 (pypdf has a possible infinite loop when loading circular /Prev entries in cross-) +7 more

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency constraint explicitly permits pypdf 4.3, and the static analysis indicates that version has multiple published advisories, including denial-of-service style infinite loop and excessive runtime issues when parsing malformed PDFs. In a document-ingest context, this is security-relevant because the library may process attacker-supplied or untrusted PDF content, making parser hangs or resource exhaustion realistically exploitable.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.