RateMyClaw

• Outcome: Review
• Latest audit: May 29, 2026 · 9:31 PM UTC
• Version: 0.5.1

Overview

The skill mostly matches its scoring purpose, but it scans and submits more sensitive environment metadata than its privacy wording clearly discloses.

Install only if you are comfortable with the skill reading broad workspace areas and sending a derived profile to ratemyclaw.com. Review generated_profile.json before submitting, especially installed skill names, integrations inferred from secrets, maturity counts, and model names. Avoid using --yes unless you accept automatic key generation and dependency installation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = [sys.executable, "-m", "pip", "install", "-r", str(req_file)]
            else:
                cmd = [sys.executable, "-m", "pip", "install", "scikit-learn"]
            result = subprocess.run(cmd, capture_output=True, text=True)
            if result.returncode == 0:
                print("  ✓ Dependencies installed!")
                print()

• Confidence: 93% confidence
• Finding: The script can invoke pip at runtime to install packages, which is beyond the core purpose of scoring/submitting a profile and introduces software supply chain risk. Even though the command is not shell-injected and uses a fixed argv list, it still executes code acquisition from external package sources and may install dependencies from a repository-controlled requirements file.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes commands that read workspace files, write generated artifacts and a saved API key, access environment variables, invoke shell/pip, and send data over the network, yet it declares no permissions. That omission reduces transparency and prevents users or hosts from making an informed consent decision about sensitive capabilities, especially because the skill scans a workspace and transmits derived metadata externally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill claims a privacy-preserving workflow centered on tags and embeddings, but the documented/observed behavior includes additional collection and transmission such as installed skill names, maturity metadata, model identifiers, and key-generation/storage behavior. This mismatch is dangerous because users may consent under a narrower understanding of what leaves the machine, leading to unintended disclosure of operational details that can fingerprint the environment.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The code reads model configuration from locations outside the declared workspace, including ~/.openclaw/openclaw.json, and adds raw model names to the generated profile. This exceeds the documented scope of a workspace-only scan and can disclose environment metadata that users would not reasonably expect to be collected or later transmitted.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The docstring states that only fixed-taxonomy tags leave the machine and that no free-form text leaves the machine, but the profile includes skills_installed and models fields containing raw local strings. This is a privacy and transparency issue because users may consent based on materially inaccurate data-handling claims.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Allowing the skill to install Python packages is unnecessary for a profile submission workflow and creates an avoidable execution path that can modify the environment and pull untrusted code. In this skill context, that capability is more dangerous because users expect local embedding and submission, not environment mutation and package installation.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script writes a derived profile of workspace contents to generated_profile.json without warning, prompting, or an option to disable persistence. While local-only storage is lower risk than exfiltration, the file can expose behavioral, tool, integration, and environment metadata to other local users, backups, or later processes.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The scanner reads content from sensitive top-level files such as SOUL.md, MEMORY.md, USER.md, TOOLS.md, AGENTS.md, HEARTBEAT.md, and WORK_STATUS.md into a consolidated text buffer. Even if only tags are intended for output, this broad ingestion increases exposure to personal, operational, or sensitive context and creates risk of over-collection beyond what users may expect from a scoring utility.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The directory scan reads text from multiple workspace folders including research, scripts, skills, memory, .secrets, and ideas, substantially broadening the corpus inspected for profiling. This is dangerous in context because the skill advertises privacy-preserving scoring, yet it ingests content from highly sensitive and personal areas that may contain confidential plans, notes, or operational details.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.