OpenClaw Repo Autopilot

• Outcome: Review
• Latest audit: May 28, 2026 · 10:51 AM UTC
• Version: 1.0.2

Overview

The skill is transparent about running an autonomous repo bot, but it can reset local work, auto-approve prompts, store a GitHub write token, and push commits without strong user checkpoints.

Install only if you intentionally want autonomous code-changing automation. Use a dedicated disposable clone or protected dev branch, start with --once, review diffs before allowing pushes, use a least-privilege GitHub token scoped to the target repo, avoid passing tokens on the command line, protect or avoid plaintext .env storage, and disable any CLI provider that should not see the repository.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

start = time.monotonic()
    logger.log("cli.interactive.start", tool=tool.name, command=cmd, prompt_path=str(prompt_path))
    proc = subprocess.run(["bash", "-lc", cmd], cwd=str(repo_dir))
    duration = time.monotonic() - start
    exit_code = proc.returncode
    reason = "completed" if exit_code == 0 else "interactive_exit_nonzero"

• Confidence: 95% confidence
• Finding: proc = subprocess.run(["bash", "-lc", cmd], cwd=str(repo_dir))

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

start = time.monotonic()

    try:
        proc = subprocess.Popen(
            cmd,
            cwd=str(repo_dir),
            stdin=subprocess.PIPE,

• Confidence: 94% confidence
• Finding: proc = subprocess.Popen( cmd, cwd=str(repo_dir), stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs use of shell commands, filesystem writes, environment sourcing, network access to GitHub, and token handling, yet it declares no permissions or safety boundaries. That mismatch can cause an agent or user to invoke powerful actions without clear consent or policy enforcement, especially because the workflow includes unattended execution and repository mutation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly instructs users to pass a GitHub token via a command-line flag and notes that it will be written into `/path/to/workdir/.env` as `GITHUB_TOKEN=...`, but it does not prominently warn about the credential exposure risks. Tokens stored in local env files can be accidentally committed, copied into logs, exposed through weak filesystem permissions, or recovered from shell history if passed directly on the command line.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README promotes unattended automation that performs `checkout/reset to origin/dev + clean`, retries/switches CLIs, and automatically commits and pushes changes, but it lacks a prominent warning that these actions can discard local work and modify remote branches without human review. In this skill context, that is more dangerous because the tool is explicitly designed for unattended operation across arbitrary repositories, increasing the chance of destructive resets or propagation of unsafe AI-generated changes.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The description is broad enough to trigger on generic requests such as setup, troubleshooting, hardening, or scaling across any repository and custom requirement. Overbroad activation increases the chance the skill is selected in contexts where the user did not intend an autonomous repo-modifying workflow, which can lead to risky execution with shell/network/write capabilities.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill promotes unattended deployment plus automatic commit/push to a dev branch, but it does not foreground a clear warning that running it will change local files, reset branch state, and push repository modifications. In this context, the risk is elevated because the runtime contract explicitly fetches, resets, retries, and commits autonomously, making unintended code changes or branch disruption more likely.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The documentation includes direct token passing on the command line and token validation steps without warning about credential exposure. Command-line secrets can leak through shell history, process listings, logs, or copied transcripts, and this skill's automation-heavy context makes such leakage more consequential because the token may grant repository write access.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The default prompt uses very broad activation language such as 'set up and run unattended optimization for any GitHub repo,' which can match common repository-help requests without clearly signaling that the skill performs autonomous, potentially write-capable operations. In the context of an autopilot skill with multi-CLI failover and auto commit/push behavior, this increases the risk of unintended activation and unsafe execution against arbitrary repositories.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The manifest advertises unattended autonomous optimization across arbitrary GitHub repositories but does not warn users that the skill may operate autonomously, use multiple CLIs, and potentially modify or push changes. Because the broader skill context includes report-only audit gates and dev-branch auto commit/push, the missing warning materially increases the chance that users invoke high-risk automation without understanding its permissions, scope, or consequences.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill automatically answers confirmation prompts with `yes` based on loose pattern matching, without surfacing the action to a user. In this context, the downstream CLIs may ask for approval before destructive file edits, command execution, network actions, or other privileged steps, so auto-confirming removes an important safety barrier.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The workspace cleanup uses `git clean -fd` to remove untracked files, only sparing configured exclusions, and does so without any user-facing warning at execution time. In an automation loop operating on a live working directory, this can irreversibly delete local artifacts, generated files, secrets, or user work that is not committed or explicitly excluded.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The rollback path performs `git reset --hard HEAD` followed by cleanup, which can discard both tracked and untracked local changes without any runtime disclosure or approval. Because this script is designed for unattended repeated operation, the destructive rollback can be triggered autonomously after audit failures, increasing the chance of silent data loss.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The playbook explicitly instructs users to populate `.env` with `GITHUB_TOKEN` and also shows a command-line example passing `--token "<github_token>"`, but it does not warn that tokens are sensitive secrets that can leak via shell history, process listings, logs, screenshots, or accidental commits. In this skill’s context—an unattended automation loop that clones repos, runs tools, and pushes changes—credential misuse or exposure is more dangerous because the token may grant repository write access and enable unauthorized code pushes or repository compromise.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The provisioning and install commands use options like `--force`, `--force-reinit`, and installation steps that can modify local files, initialize environments, and alter machine or repository state, but the playbook does not clearly warn users before these actions. In an automation skill designed for unattended operation and auto commit/push, silent state-changing setup steps are riskier because users may run them on the wrong host or repository and unintentionally overwrite configuration, reset workspaces, or trigger automated pushes.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: If --token is provided, the script writes the GitHub token directly into output_dir/.env on disk without enforcing restrictive permissions or warning the user about credential persistence. In an unattended autopilot skill that later runs automation and git operations, storing secrets in plaintext increases the chance of accidental disclosure via backups, misconfigured permissions, or inclusion in workspace artifacts.

VirusTotal

VirusTotal findings are pending for this skill version.