Security audit

Openclaw Auto Training Skill

Security checks across malware telemetry and agentic risk

Overview

This self-training skill is transparent about its goal, but it can permanently install new skills and share evaluation summaries with too little user control.

Review before installing. Use it only on non-sensitive tasks, with a restricted OpenRouter key and budget. Require manual approval before any `clawhub install`, disable or approve BotLearn posting per run, and inspect or delete `memory/qa-eval-*` logs if they contain private information.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill includes autonomous posting of self-evaluation summaries to BotLearn, which is outside the core function of local QA/self-improvement and creates an unnecessary data-exfiltration path. Because the post is triggered merely by the presence of the botlearn skill rather than explicit per-run human consent, it can disclose internal performance data, installed skills, and derived insights to an external/public destination.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The document says eval results should not be shared publicly without permission, but later instructs the agent to post automatically if botlearn is installed. This contradiction is dangerous because the operational step overrides the safety expectation in practice, leading to unauthorized disclosure of evaluation outputs and potentially sensitive operational metadata.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrases are broad everyday language such as 'learn new skills' and 'evaluate yourself', which can cause accidental activation during normal conversation. In this skill, accidental activation is especially risky because it can start external API calls, persistent logging, and autonomous skill installation without a clearly intentional invocation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill description also fails to clearly disclose that task prompts and agent responses are sent to an external LLM service (OpenRouter) for judging. That omission creates a data-handling and privacy risk because users may not realize potentially sensitive content is leaving the local environment.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill description also fails to clearly disclose that task prompts and agent responses are sent to an external LLM service (OpenRouter) for judging. That omission creates a data-handling and privacy risk because users may not realize potentially sensitive content is leaving the local environment.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The skill persists detailed evaluation results to memory files and may publish summaries externally, while the evaluated tasks can involve user-provided, researched, or otherwise sensitive content. This creates both a local data-retention risk and a potential disclosure risk if logs or summaries contain proprietary prompts, outputs, findings, or inferred operational weaknesses.

Ssd 4

Medium

Confidence: 97% confidence
Finding: The retry loop uses low judge scores to trigger autonomous installation of new skills, creating a self-reinforcing expansion path with weak approval boundaries. In context, this is more dangerous because broad triggers can unintentionally start the process, and suggested skills originate from an external model output that may be wrong, overprivileged, or manipulated, leading to capability creep and increased attack surface.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.