Oc

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:16 AM UTC
• Version: 1.1.0

Overview

This skill is a real troubleshooting tool, but some repair and setup paths can make broad local or network-facing changes without enough scoping or warning.

Install only if you want a repair-capable OpenClaw maintenance tool, not just read-only diagnostics. Use dry-run/check-only modes first, review any `--auto-fix` action before running it, avoid using the generated gateway config as-is on a networked machine, and do not paste or share outputs containing API keys or tokens.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (97)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises executable shell-based installation and operational commands, but the manifest does not clearly declare the effective permissions or operational scope implied by shell execution, file access, and environment interaction. This can mislead users and orchestrators about the true trust boundary, increasing the chance of unexpected local changes or command execution under broad activation conditions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose frames the skill as a diagnostic and recommendation tool, but the described behavior extends into setup, self-updating, network retrieval, cache management, and automated local configuration changes. This mismatch is dangerous because users may invoke it expecting read-only troubleshooting while it performs state-changing actions such as installs, updates, and file edits.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The document presents auto-fix behavior that reads API keys from a .env file and templates .env content, while later claiming auto-fix cannot modify .env secrets. This inconsistency can cause operators or downstream agents to over-trust the guardrails and permit credential-handling automation that may expose, overwrite, or misroute secrets.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The PATH fix appends to ~/.bashrc or ~/.zshrc, which contradicts the later safety statement that auto-fix cannot edit system files. Even if shell profiles are user-scoped rather than system-wide, this is still persistent environment modification and the contradictory guardrail can mislead users about the permanence and scope of changes.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The generated configuration binds the gateway to 0.0.0.0, enables token-based remote access with a predictable default token derived from the API key, and sets sandboxMode to relaxed. For a diagnostic/recommendation skill, creating a network-exposed agent with weakened containment materially expands attack surface and can allow unauthorized access or unsafe agent actions if deployed as generated.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: These helpers perform global npm installs of pnpm and openclaw, which changes the host environment and executes package installation scripts with the user's privileges. In a diagnostic tool, this exceeds read-only or advisory behavior and introduces supply-chain and system-integrity risk if the package source is compromised or the action is triggered unexpectedly.

Missing User Warnings

High

• Confidence: 89% confidence
• Finding: The README explicitly normalizes potentially system-altering actions such as killing processes, changing permissions, installing packages, starting services, and modifying firewall rules under auto-fix workflows without prominent warnings, prerequisites, or approval boundaries. In an AI-agent skill context, that can encourage unsafe invocation of powerful remediation actions by users or automation, increasing the chance of accidental service disruption or host misconfiguration.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The activation guidance is broad enough that the skill could be invoked for many generic support or setup requests without establishing whether the user wants diagnostic advice or permission for automated fixes and updates. In the context of a skill that can run shell commands and modify local state, ambiguous triggers materially increase the risk of unintended execution.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill promotes auto-fix, setup, and update capabilities without prominently warning that these actions may install software, modify configuration, refresh caches, or otherwise alter local system state. In a troubleshooting context, users may reasonably assume low-risk diagnostics, making the missing warnings a meaningful safety issue.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger condition `skill_search` is broad and lacks scope constraints, which can cause the complementary skill to activate in situations beyond explicit diagnostic or dependency-related workflows. In a skill that orchestrates other skills, ambiguous activation increases the risk of unintended tool invocation, privilege expansion, or data flow into external integrations.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger condition `share_fix` is underspecified and can be interpreted broadly, potentially invoking community-support integrations when internal diagnostic information should remain private. Because this manifest links to external communication channels, vague triggers materially raise the chance of accidental disclosure or unintended automated behavior.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The manifest explicitly states `Auto-create GitHub issues for unresolved errors` without any indication of user consent, review, or sanitization before sending data to an external service. Error details often contain stack traces, file paths, secrets, or proprietary context, so automatic issue creation can leak sensitive information outside the local environment.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: Automatic team notifications for `critical_error` can disclose internal system state, logs, or incident details to external messaging systems without warning the user. In diagnostic tooling, this is especially risky because failures may include confidential operational data, making silent outbound notification a meaningful data-exposure vulnerability.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The community-support integration suggests notifying or seeking help from a public or semi-public Discord channel without any warning about external sharing. This is dangerous because unresolved errors and fixes can include proprietary code, infrastructure details, credentials in logs, or other sensitive context that should never be automatically exposed to a community forum.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The recipe includes forceful process termination commands (`kill -9` / `taskkill /F`) against a port-selected process without an explicit warning that this may abruptly stop unrelated services, interrupt active work, or cause data loss. In a diagnostic/fix skill, operators may run this as a suggested remediation, so lack of cautionary context increases the chance of unsafe disruption.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The `openclaw doctor --fix` command can modify configuration automatically, but the recipe does not tell the user what may change or warn that settings could be rewritten. In a repair tool, silent or poorly explained config mutation can cause unexpected behavior and make recovery harder if the fix is wrong.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The force restart recipe uses `pkill -9` or `taskkill /F` and then forces a gateway start, but does not warn about service interruption, dropped in-flight work, or potential state corruption. Because this is a gateway-management action in a production-like tool, the operational impact is meaningful even if the intent is maintenance.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The sandbox reset recipe stops and removes a container, which irreversibly deletes container state, but the recipe lacks a warning about loss of unsaved changes or debugging context. In a troubleshooting skill, users may treat this as routine, making omission of the warning materially risky.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This cleanup recipe performs irreversible deletions with `find ... -delete` and `docker system prune -f` but does not explicitly warn that logs and Docker resources will be permanently removed. In a maintenance context, these commands can destroy forensic evidence, cached build state, or resources needed by other workloads.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: Several hook trigger conditions are loosely defined, such as events that could be interpreted differently by implementations, which increases the chance of unintended automatic activation of follow-on actions. In this skill, those actions include recommending or initiating diagnostics, notifications, or installs, so ambiguous triggering can lead to unnecessary external actions, alert fatigue, or unsafe automation paths.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger condition "team_environment" is too vague to safely govern notification behavior because it does not specify how a team context is detected or validated. In this file, that ambiguity controls a Slack alert action, which could cause unintended message posting, disclosure of diagnostic details, or notification spam if the condition is matched too broadly.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly recommends commands that display authentication material, such as reading API key config values and grepping environment variables, without warning users about exposing secrets in terminals, shell history, logs, or screen sharing. In a diagnostic skill, this increases the chance of accidental credential disclosure even if the intent is troubleshooting.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The fix section instructs users to set secrets directly on the command line and append them to .env without warning that secrets may be captured in shell history, process arguments, audit logs, or stored insecurely. This is risky because authentication material is handled in plaintext during remediation steps.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The required variables section enumerates several sensitive tokens and keys but does not include any privacy or handling warning. In aggregate, this normalizes broad secret collection and may prompt users to copy, paste, or disclose multiple live credentials during troubleshooting.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The instructions include `killall openclaw`, a potentially destructive process-termination command, without warning about impact on other instances, active sessions, or unsaved work. In environments with multiple services or users, this can cause unintended denial of service or operational disruption.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: references/installation-errors.md:517

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: references/troubleshooting-workflow.md:354