ClawHub
Back to skill

Security audit

context-clean-up

Security checks across malware telemetry and agentic risk

Overview

This skill is an audit-only context cleanup helper; it inspects local OpenClaw session/context data and gives guidance, with no evidence of hidden network transfer or automatic changes.

Install only if you are comfortable with a skill inspecting OpenClaw session history for context-bloat analysis. Treat generated JSON reports as private, review them before sharing, and use the out-of-band notification advice only with channels you control and with sensitive details redacted.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The document explicitly recommends sending cron output through external messaging platforms, which introduces a networked data-delivery capability outside the stated audit-only scope of the skill. Even if framed as a UX optimization, this can expose sensitive content to third-party channels and bypass normal transcript visibility and review.

Description-Behavior Mismatch

Medium
Confidence
82% confidence
Finding
The guidance extends beyond passive analysis by recommending writing details to files and sending links or paths, which adds operational behavior not aligned with an audit-only cleanup skill. This broadens the skill from reporting into data staging and alternate delivery, increasing the chance of unintended retention, disclosure, or misuse.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation tells operators to send content through external platforms without warning that those channels may expose data to third parties, logs, or misdelivery risks. Omitting that warning makes accidental disclosure more likely, especially because the pattern is presented as recommended operational guidance.

Exfiltration Commands

High
Category
Prompt Injection
Content
## Pattern

Inside the isolated cron worker:
1) Send the message to the user using the platform tool (Telegram/Discord/Slack/etc.)
2) Output exactly `NO_REPLY`

This makes the cron run "silent" from the perspective of the main session transcript, while still delivering the content to the user.
Confidence
70% confidence
Finding
Send the message to

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.