ClawHub
Back to skill

Security audit

Heleni Maintenance

Security checks across malware telemetry and agentic risk

Overview

This maintenance skill has a plausible purpose, but it gives an agent broad unattended authority to upload the whole workspace, read GitHub credentials, update its own environment, and modify OpenClaw session state.

Review before installing. Only use this skill if you intentionally want scheduled GitHub backups and automated OpenClaw maintenance. Configure a private repository, use least-privilege credentials through a secret manager, exclude secrets and private notes, review files before pushes, avoid printing tokens, keep cron jobs visible and easy to disable, and require explicit confirmation before updates, session cleanup, or gateway restarts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The manifest claims the skill only performs backup and update operations, but the body also includes session-store cleanup and gateway restarts. This hidden capability increases the chance of users or orchestrators invoking a state-destructive action without informed consent, especially because cleanup rewrites application state and restarts a service.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger phrase "run maintenance" is so broad that it can activate backup, updates, cleanup, token discovery, or service restarts without the user clearly intending those actions. Broad triggers are dangerous here because the skill performs privileged and potentially disruptive operations, including silent cron-driven git pushes and gateway restarts.

Missing User Warnings

High
Confidence
98% confidence
Finding
This section instructs the agent to search for GitHub tokens in remotes, environment variables, and local credential files, then silently push the entire workspace to GitHub on a cron schedule. Omitting a clear warning about credential access and automated exfiltration-like behavior is dangerous because sensitive workspace contents may be transferred off-host without explicit user awareness each time.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The cleanup routine rewrites sessions.json and restarts the gateway, but the description does not prominently warn about application-state mutation, possible data loss, or temporary service disruption. Hidden destructive maintenance steps are risky because a user may expect benign cleanup while the skill actually deletes session history and bounces a production component.

Self-Modification

High
Category
Rogue Agent
Content
---
name: workspace-maintenance
description: "Unified workspace maintenance skill. Covers: (1) backing up the workspace to GitHub git repo, and (2) updating OpenClaw and skills. Use when: asked to backup, push to git, update openclaw, update skills, or run maintenance."
---

# Maintenance Skill
Confidence
94% confidence
Finding
update skill

Self-Modification

High
Category
Rogue Agent
Content
## Trigger Phrases
- "backup workspace" / "push to git" / "save to github"
- "update openclaw" / "update skills" / "run maintenance"
- Runs automatically on schedule (see Cron section)

---
Confidence
94% confidence
Finding
update skill

Self-Modification

High
Category
Rogue Agent
Content
### When to Run
- Weekly on Sunday at 03:00 UTC (cron)
- When owner says "update openclaw" or "update skills"
- After a new OpenClaw version is released

### Step 1 — Update OpenClaw
Confidence
95% confidence
Finding
update skill

Self-Modification

High
Category
Rogue Agent
Content
openclaw --version
```

### Step 2 — Update Skills via ClawHub

```bash
# Update all installed skills to latest
Confidence
95% confidence
Finding
Update Skill

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.