ClawHub
Back to skill

Security audit

Ocuclaw Assist

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed setup and troubleshooting guide for OcuClaw that uses meaningful system and network changes, but they fit its stated purpose and include user-control guardrails.

Install only if you are comfortable letting this guide change OpenClaw configuration, install/update the OcuClaw plugin, configure Tailscale private networking, and restart services. Prefer official package-manager or signed-installer Tailscale instructions if you do not want to run the curl-to-shell command, keep relay and Even AI tokens private, and review optional Soniox, Even AI, and debug-upload steps before enabling them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The guide instructs users to execute `curl -fsSL https://tailscale.com/install.sh | sh`, which downloads and immediately runs remote code in a shell. Even though the source is a legitimate vendor and the context is a setup guide, piping a network-fetched script to `sh` bypasses normal review and integrity checks and becomes dangerous if the URL, transport, or upstream distribution channel is compromised.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.