Safe Config Workflow

• Outcome: Pass
• Latest audit: May 28, 2026, 10:04 AM
• Version:
  1.0.0

Overview

This is a safety-oriented OpenClaw configuration workflow with a minor activation-scope caution, not evidence of malicious behavior.

Install this only for OpenClaw configuration work. Before allowing changes, confirm the target is ~/.openclaw/openclaw.json or another OpenClaw component, review the proposed change and backup path, and avoid using the skill for unrelated application or system configuration tasks.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger conditions are broad enough to activate on generic configuration-related requests, not just clearly scoped OpenClaw tasks. In an agent environment, this can cause the wrong skill to take over and steer the model into file edits, command suggestions, and workflow steps for unrelated systems, increasing the chance of misconfiguration or unsafe actions.

VirusTotal

66/66 vendors flagged this skill as clean.