[Only test] Monitor Openclaw Server

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 1.0.0

Overview

The skill is a small system monitor, but it sends host resource data to a fixed external webhook every time it runs.

Review before installing. Only use this skill if you are comfortable with uptime, load, memory, swap, and disk usage being sent to the hard-coded webhook; otherwise remove or disable the curl POST line and make remote reporting explicitly opt-in with a user-controlled endpoint.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documentation indicates shell execution via a local monitor script, but no permissions are declared to make that capability explicit. Hidden or undocumented command execution reduces transparency and prevents proper policy enforcement, which is risky even if the intended function is system monitoring.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill is presented as a local resource monitor, but the documented behavior includes sending collected system metrics to an external webhook with curl. This mismatch is dangerous because users and operators may approve the skill expecting local-only behavior while it actually exfiltrates potentially sensitive host information over the network.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The feature list explicitly mentions sending data to a monitor server via webhook, which conflicts with the stated framing of a clean local monitor. Even if marked as 'only for testing,' undocumented or weakly justified external transmission can leak operational details such as uptime, load, disk usage, and memory state.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Webhook-based communication is not necessary for the stated purpose of local system status reporting, so its presence expands the attack surface without clear justification. Any unnecessary outbound connectivity creates opportunities for data leakage, misuse, or covert monitoring of the host environment.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The script's declared purpose is local system resource reporting, but it collects host metrics and unconditionally sends them to an external webhook. This creates an undisclosed data exfiltration path and violates the principle of least surprise, especially for an admin-facing monitoring utility expected to operate locally.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Posting uptime, load, memory, swap, and disk usage to a third-party webhook is unjustified for a skill described only as a local monitor. Even if the data seems low sensitivity, it can reveal host characteristics, operational state, and infrastructure patterns useful for reconnaissance.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The comment claiming the webhook is 'only for testing' is inconsistent with code that always posts live system data, which can mislead reviewers and users about actual behavior. This mismatch increases risk because it normalizes hidden exfiltration and may cause the transmission to escape scrutiny during deployment.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases like 'system status' and 'server health' are broad and likely to overlap with normal conversation, increasing the chance of unintended activation. Because activation leads to script execution, accidental triggering could expose system information or initiate networked behavior without deliberate user intent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The usage section states that asking for status causes execution of a local shell script, but it does not warn users that command execution will occur. Silent command execution is risky because users may believe they are requesting a harmless summary while the agent is actually invoking system-level operations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The feature mentioning a test webhook provides no privacy or network warning despite implying outbound transmission of system metrics. Users may unknowingly expose operational information to a remote service, which is especially concerning in a server-monitoring context where host telemetry can aid reconnaissance.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script provides no user-facing warning, prompt, or configuration before transmitting collected system metrics externally. In the context of a simple local resource monitor, this undisclosed behavior is more dangerous because users would reasonably not expect any network egress.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.