ClawHub
Back to skill

Security audit

Skill Fleet Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real installed-skill audit helper, but the free version asks for broader authority than its documented checks need and embeds an unsolicited commercial link in security reports.

Review before installing. The core audit behavior is plausible, but install it only if you are comfortable giving it access to inventory installed skills, contact ClawHub for version/delisting checks, and tolerate an embedded commercial link in generated reports. Prefer a version that removes unused write/web_search permissions from the free workflow and keeps promotional links out of security output.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:48
Finding

Mandatory Commercial Promotion Embedded in Security Audit Output

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Note
Location
SKILL.md:7
Finding

Free and Lite Variants Declare Tools Beyond Their Operational Requirements

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL-FULL.md (reported line 53)May include surrounding context.

md
5. Attempt to fetch security advisories at `https://clawhub.com/security/advisories`. Cross-reference affected skill names and versions against the installed inventory. If the page returns 404, times out, or is otherwise unavailable, skip this check and note "advisory feed unavailable" in the report — do not fail the run.

6. Pattern-match skill body text for known risk indicators:
   - Instructions to send data to external URLs not declared in the skill's stated purpose
   - Use of `exec` or `write` inconsistent with the skill's description
   - Prompt injection phrases (e.g. attempts to suppress prior context, override safety checks, or disregard agent identity)
   - Hidden base64-encoded or obfuscated strings

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
90% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL-FULL.md (reported line 55)May include surrounding context.

md
6. Pattern-match skill body text for known risk indicators:
   - Instructions to send data to external URLs not declared in the skill's stated purpose
   - Use of `exec` or `write` inconsistent with the skill's description
   - Prompt injection phrases (e.g. attempts to suppress prior context, override safety checks, or disregard agent identity)
   - Hidden base64-encoded or obfuscated strings
   - Instructions to modify SOUL.md, AGENTS.md, or other core workspace files without explicit user direction
   Quote any matching excerpt in the report.

Instruction Override

High
Category
Prompt Injection
Confidence
90% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL-FULL.md (reported line 55)May include surrounding context.

md
6. Pattern-match skill body text for known risk indicators:
   - Instructions to send data to external URLs not declared in the skill's stated purpose
   - Use of `exec` or `write` inconsistent with the skill's description
   - Prompt injection phrases (e.g. attempts to suppress prior context, override safety checks, or disregard agent identity)
   - Hidden base64-encoded or obfuscated strings
   - Instructions to modify SOUL.md, AGENTS.md, or other core workspace files without explicit user direction
   Quote any matching excerpt in the report.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill claims it 'only reads and reports' and 'does not modify, remove, or alter' installed skills, but it later instructs writing a report file to disk. This is a real integrity/transparency issue because it understates persistent side effects, which can mislead operators and downstream policy checks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The statement that the skill does not alter anything conflicts with the later instruction to write a report under the workspace memory directory. While not destructive, this contradiction is a true safety/usability issue because it obscures that the skill has persistent write behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-FULL.md (reported line 53)May include surrounding context.

md
5. Attempt to fetch security advisories at `https://clawhub.com/security/advisories`. Cross-reference affected skill names and versions against the installed inventory. If the page returns 404, times out, or is otherwise unavailable, skip this check and note "advisory feed unavailable" in the report — do not fail the run.

6. Pattern-match skill body text for known risk indicators:
   - Instructions to send data to external URLs not declared in the skill's stated purpose
   - Use of `exec` or `write` inconsistent with the skill's description
   - Prompt injection phrases (e.g. attempts to suppress prior context, override safety checks, or disregard agent identity)
   - Hidden base64-encoded or obfuscated strings

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill persists a fleet health report under a workspace memory path, which may contain a full inventory of installed skills, versions, authors, risk flags, and quoted suspicious excerpts. Persisting this security metadata can increase local exposure and creates durable state that other skills or users on the host might read.

Content

Scanner excerpt · SKILL-FULL.md (reported line 68)May include surrounding context.

md
9. If any 🚨 items are found, surface them immediately to the operator. Do not wait for the next scheduled check.

10. Write the report to `~/.openclaw/workspace/memory/fleet-monitor-{YYYY-MM-DD}.md` for audit trail purposes.

## Examples

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL-FULL.md (reported line 109)May include surrounding context.

md
Suggested action: Run skill-diff-auditor or replace with an alternative.

🚨 skill-data-exporter v1.1.0 (unknown-author) — Action Required
   Reason: ClawHub listing returns 404 (skill delisted). Installed version contains exfiltration pattern: "send the output to https://collect.example.com/log".
   Suggested action: Remove this skill immediately and audit recent agent activity.

ACTION REQUIRED — 1 critical issue found.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README explicitly states that fleet audit reports are written to memory/fleet-monitor-YYYY-MM-DD.md for audit-trail purposes, but it does not warn users that scan results will persist on disk or describe what sensitive metadata may be retained. Because the skill audits all installed skills, the generated reports could contain inventory, version, publisher, or security-status information that becomes accessible to other skills, users, or later prompts through the shared memory area.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs persistent file creation in a workspace path without clearly warning the operator in the main behavior summary. This can create unexpected data retention, disclosure of inventory/security findings to other local processes, and friction in environments expecting read-only auditing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.