ClawHub
Back to skill

Security audit

Openclaw Skill Packager

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward OpenClaw skill packager that discloses its local validation, copying, and secret-checking behavior.

Before installing, understand that the skill will inspect and copy OpenClaw skill folders and scan them for secrets. Use it only on intended skill paths, and review generated packages before sharing them externally.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The README says to use the skill 'when the conditions in the description are met' and defers the real trigger scope to another file, which leaves activation criteria underspecified in this file. In agentic systems, ambiguous invocation guidance can cause the skill to be selected in unintended contexts, increasing the chance of misuse or overbroad access during packaging or validation workflows.

Static analysis

No suspicious patterns detected.