configure OpenClaw

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:17 PM UTC
• Version:
  1.1.0

Overview

This skill is a broad but disclosed OpenClaw configuration helper that requires user approval before changing the config.

Install this only if you want an assistant to help edit OpenClaw configuration. Review every proposed patch carefully before approving changes, especially for auth, env, hooks, plugins, commands, gateway, browser, sandbox, skills, or any suggested auto-repair command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill description is extremely broad and can match almost any request related to configuration, startup failures, or unknown fields. That increases the chance this skill is invoked in situations outside its narrow safe scope, which can lead to inappropriate file-edit guidance or unintended modification of sensitive OpenClaw settings.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill instructs the agent to fetch live documentation when a field is unfamiliar, but it does not require notifying the user that a network request will occur. In a configuration skill, silent external fetches can leak usage context or environment details and violate user expectations in privacy-sensitive deployments.

VirusTotal

65/65 vendors flagged this skill as clean.