ClawHub
Back to skill

Security audit

ClawDefender - OpenClaw Security - Prompt injection, rogue skills etc

Security checks across malware telemetry and agentic risk

Overview

ClawDefender is a coherent defensive scanner/sanitizer, with disclosed but imperfect install, URL-checking, and logging behavior users should understand before relying on it.

Install only if you want a local heuristic security helper that scans workspace skills/scripts and can assist with skill installation. Do not treat --check-url or --install as a complete safety boundary: --install installs first and scans afterward, and the URL allowlist is simple pattern matching. Review findings manually before acting on them, and only add HEARTBEAT or cron usage if you want persistent future behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (30)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
This is a mismatch because the description presents the skill as a scanner/sanitizer used to protect agents from malicious content, but the code also has operational capabilities beyond scanning: it installs external skills, modifies the workspace by deleting installed skills, and writes persistent audit logs. Those behaviors are not mentioned in the description. The core scanning claims are mostly accurate, but criterion (1) is met because the code performs additional capabilities not declared.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The manifest describes a security scanner and input sanitizer for AI agents, but this script also installs skills from ClawHub and conditionally deletes installed directories. While scanning newly installed skills is aligned with the stated use case, performing the package installation itself is a separate package-management capability not justified by the core purpose of scanning and sanitization.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The usage text and function framing present '--install' as 'Safe skill installation', implying the installation is security-vetted. In reality, the code runs 'npx clawhub install' first and only scans afterward, meaning untrusted code is already present before review. That is an intent-level contradiction in the script's own documentation and UX messaging.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
This shell script can irreversibly delete the installed skill directory with `rm -rf "$installed_path"`. Although it asks for confirmation at L618, there is no explicit warning that declining to keep the skill will delete files from disk, which weakens user disclosure for a destructive operation.

External Transmission

Medium
Category
Data Exfiltration
Content
./scripts/clawdefender.sh --audit

# Sanitize external input before processing
curl -s "https://api.example.com/..." | ./scripts/sanitize.sh --json

# Validate a URL before fetching
./scripts/clawdefender.sh --check-url "https://example.com"
Confidence
50% confidence
Finding
https://api.example.com/

External Transmission

Medium
Category
Data Exfiltration
Content
echo "some text" | ./scripts/sanitize.sh

# Check JSON API responses
curl -s "https://api.example.com/data" | ./scripts/sanitize.sh --json

# Strict mode - exit 1 if injection detected (for automation)
cat untrusted.txt | ./scripts/sanitize.sh --strict
Confidence
50% confidence
Finding
https://api.example.com/

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
- `rm -rf`, `mkfs`, `dd if=`
- Fork bombs `:(){ :|:& };:`
- Reverse shells, pipe to bash/sh
- `chmod 777`, `eval`, `exec`

### SSRF / Data Exfiltration
Confidence
80% confidence
Finding
chmod 777

Credential Access

High
Category
Privilege Escalation
Content
### Path Traversal

- `../../../` sequences
- `/etc/passwd`, `/etc/shadow`, `/root/`
- URL-encoded variants (`%2e%2e%2f`)

## Automation Examples
Confidence
60% confidence
Finding
/etc/passwd

Credential Access

High
Category
Privilege Escalation
Content
### Path Traversal

- `../../../` sequences
- `/etc/passwd`, `/etc/shadow`, `/root/`
- URL-encoded variants (`%2e%2e%2f`)

## Automation Examples
Confidence
95% confidence
Finding
/etc/shadow

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
COMMAND_INJECTION=(
    'rm -rf /'
    'rm -rf \*'
    'chmod 777'
    'mkfs\.'
    'dd if=/dev'
    ':\(\)\{ :\|:& \};:'
Confidence
80% confidence
Finding
chmod 777

Credential Access

High
Category
Privilege Escalation
Content
'.ssh/id_'
    '.gnupg'
    '\.\./\.\./\.\.'
    '/etc/passwd'
    '/etc/shadow'
    '/root/'
    '~/.ssh/'
Confidence
60% confidence
Finding
/etc/passwd

Credential Access

High
Category
Privilege Escalation
Content
'.gnupg'
    '\.\./\.\./\.\.'
    '/etc/passwd'
    '/etc/shadow'
    '/root/'
    '~/.ssh/'
    '~/.aws/'
Confidence
95% confidence
Finding
/etc/shadow

Credential Access

High
Category
Privilege Escalation
Content
'cat.*[.]env'
    'read.*[.]env'
    'show.*[.]env'
    '/.env'
    'config.yaml'
    'config.json'
    '.ssh/id_'
Confidence
60% confidence
Finding
.env'

Credential Access

High
Category
Privilege Escalation
Content
echo ""
    echo -e "${BLUE}[3/3] System checks...${NC}"
    
    # Check .env permissions
    if [ -f "$WORKSPACE/.env" ]; then
        local perms=$(stat -c %a "$WORKSPACE/.env" 2>/dev/null || echo "unknown")
        if [ "$perms" != "600" ] && [ "$perms" != "unknown" ]; then
Confidence
60% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
echo -e "${BLUE}[3/3] System checks...${NC}"
    
    # Check .env permissions
    if [ -f "$WORKSPACE/.env" ]; then
        local perms=$(stat -c %a "$WORKSPACE/.env" 2>/dev/null || echo "unknown")
        if [ "$perms" != "600" ] && [ "$perms" != "unknown" ]; then
            echo -e "  ${YELLOW}⚠${NC} .env has loose permissions ($perms, should be 600)"
Confidence
60% confidence
Finding
.env"

Credential Access

High
Category
Privilege Escalation
Content
# Check .env permissions
    if [ -f "$WORKSPACE/.env" ]; then
        local perms=$(stat -c %a "$WORKSPACE/.env" 2>/dev/null || echo "unknown")
        if [ "$perms" != "600" ] && [ "$perms" != "unknown" ]; then
            echo -e "  ${YELLOW}⚠${NC} .env has loose permissions ($perms, should be 600)"
        else
Confidence
60% confidence
Finding
.env"

Credential Access

High
Category
Privilege Escalation
Content
if [ -f "$WORKSPACE/.env" ]; then
        local perms=$(stat -c %a "$WORKSPACE/.env" 2>/dev/null || echo "unknown")
        if [ "$perms" != "600" ] && [ "$perms" != "unknown" ]; then
            echo -e "  ${YELLOW}⚠${NC} .env has loose permissions ($perms, should be 600)"
        else
            echo -e "  ${GREEN}✓${NC} .env permissions OK"
        fi
Confidence
60% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
if [ "$perms" != "600" ] && [ "$perms" != "unknown" ]; then
            echo -e "  ${YELLOW}⚠${NC} .env has loose permissions ($perms, should be 600)"
        else
            echo -e "  ${GREEN}✓${NC} .env permissions OK"
        fi
    fi
Confidence
60% confidence
Finding
.env

Instruction Override

High
Category
Prompt Injection
Content
### Prompt Injection (90+ patterns)

**Critical** - Direct instruction override:
- `ignore previous instructions`, `disregard.*instructions`
- `forget everything`, `override your instructions`
- `new system prompt`, `reset to default`
- `you are no longer`, `you have no restrictions`
Confidence
80% confidence
Finding
ignore previous instructions

Instruction Override

High
Category
Prompt Injection
Content
'contents.*[.]env'
    'show.*[.]env'
    'what.*in.*config'
    'ignore previous instructions'
    'ignore all previous'
    'ignore your instructions'
    'disregard above'
Confidence
80% confidence
Finding
ignore previous instructions

Instruction Override

High
Category
Prompt Injection
Content
'disregard above'
    'disregard.*instructions'
    'disregard.*prompt'
    'disregard previous'
    'forget.*instructions'
    'forget everything'
    'forget your instructions'
Confidence
80% confidence
Finding
disregard previous

Instruction Override

High
Category
Prompt Injection
Content
'disregard previous'
    'forget.*instructions'
    'forget everything'
    'forget your instructions'
    'forget everything above'
    'override your instructions'
    'new system prompt'
Confidence
80% confidence
Finding
forget your instructions

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- `rm -rf`, `mkfs`, `dd if=`
- Fork bombs `:(){ :|:& };:`
- Reverse shells, pipe to bash/sh
- `chmod 777`, `eval`, `exec`

### SSRF / Data Exfiltration
Confidence
80% confidence
Finding
chmod 777

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# Command injection patterns
COMMAND_INJECTION=(
    'rm -rf /'
    'rm -rf \*'
    'chmod 777'
    'mkfs\.'
Confidence
100% confidence
Finding
rm -rf /

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:103