ClawHub

Skill Dependencies

Security checks across malware telemetry and agentic risk

Overview

This skill matches its dependency-management purpose, but its installer can persistently add multiple other skills from ClawHub without separate review for each install.

Use the read-only scan, tree, conflict, and search commands normally. Before running skill-install.sh, review the dependency list, confirm the exact skills and versions you intend to install, and remember that installed skills persist and can affect future OpenClaw behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documents multiple shell commands and operational capabilities but does not declare any permissions, which creates a transparency and policy-enforcement gap. In practice this can cause the agent to execute filesystem-scanning or install-related commands without users or platform controls having an explicit permission model to gate those actions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal