Security audit

灵枢·Agent设计师

Security checks across malware telemetry and agentic risk

Overview

The skill is transparent about designing and publishing agents, but its broad triggers and force-push release workflow create enough risk to require user review before installation.

Install only if you want an agent-design skill that can help create local OpenClaw skill files and guide GitHub/ClawHub publication. Before any publish step, require an explicit target repository, version, destination, diff review, and final confirmation; avoid the documented git push --force path unless you deliberately intend to rewrite remote history.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill claims publication requires a diff preview and user confirmation, but the documented release path includes a direct Git push workflow that can overwrite remote history. This mismatch is dangerous because an agent or operator may rely on the automation path and perform a repository-altering action without a strong technical guardrail enforcing the confirmation step.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill embeds destructive Git force-push capability even though its primary purpose is Agent design and planning, not repository administration or history rewriting. If triggered incorrectly or used on the wrong repo, it can overwrite commit history, destroy collaborators' work, and publish unintended or unreviewed content.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger conditions for the main skill are broad enough to overlap with many ordinary requests about designing, creating, optimizing, or publishing agents. In an agent platform, this can cause unintended activation of the skill, leading to unexpected workflow execution, prompt/context takeover, or accidental initiation of publishing-related steps in situations where the user did not explicitly request this specialized skill.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The enterprise-agent-planner trigger is defined so loosely that providing general company information or documents may be enough to activate it, even when the user may only want summarization or analysis. This increases the risk of misrouting sensitive enterprise content into a planning workflow that may produce unintended outputs or invoke downstream actions inappropriate for the user's actual intent.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger phrases are broad enough to match common user requests like designing an agent, configuring files, or discussing how a domain could use agents. Overbroad activation increases the chance the skill takes control in situations where the user intended only discussion, causing unintended file creation, configuration changes, or progression toward release actions.

Vague Triggers

High

Confidence: 94% confidence
Finding: The publishing triggers include generic phrases such as '更新技能包' and '发布新版本', which can appear in ordinary conversation and may unintentionally invoke a release workflow. In a skill that also contains repository and package publication commands, ambiguous triggers materially increase the risk of accidental deployment or publication.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The documentation presents a force-push command without a clear warning about its destructive behavior or the circumstances under which it is safe to use. This is dangerous because users or agents may treat it as a normal release step, leading to irreversible branch rewrites and loss of trusted history.

VirusTotal

50/50 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.