Phy Skill Scanner

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:23 PM UTC
• Version:
  1.0.3

Overview

This is a disclosed scanner for reviewing other skill files, and its examples, file/URL inputs, and batch mode fit that purpose without hidden execution or credential handling.

Install this only if you want a heuristic review aid for OpenClaw skill files. Prefer explicit use with /skill-scanner, provide only the file, directory, or URL you intend to inspect, and treat its verdicts as guidance rather than a guarantee.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill instructs the agent to assess signals such as author publication history and GitHub commit recency, which can push the agent beyond analyzing a supplied SKILL.md into external repository or network investigation. That broadens the skill’s operational scope and may cause unexpected access or behavior inconsistent with a local, static scanner.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The description frames the skill as analyzing a SKILL.md file, but the documented inputs also include arbitrary URLs and batch scans of local skill directories. This mismatch expands the trust boundary and can lead users to grant broader filesystem or network access than the headline description suggests.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases in the description include broad natural-language activators such as 'is this skill safe' and 'check skill security,' which may collide with ordinary conversation. Ambiguous activation increases the chance the skill runs unintentionally on unrelated content.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The documented trigger phrase list repeats ambiguous conversational activators without clear boundaries or required prefixes. This can cause accidental invocation and unintended processing of user-provided content or local paths.

VirusTotal

65/65 vendors flagged this skill as clean.