ClawHub
Back to skill

Security audit

Token Connection Guard

Security checks for vulnerabilities and agentic risk

Overview

This skill provides resource-management guidance for OpenClaw and does not include executable code, hidden persistence, credential access, or destructive behavior.

Installers should understand this is a behavioral guidance skill for conserving resources and handling provider failures. It appears proportionate, but users should still ensure any caching or failure logging in their agent environment avoids storing secrets or stale real-time data.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The usage instruction says to use the skill 'when the conditions in the description are met,' but it does not define concrete trigger criteria in the README itself. This ambiguity can cause inconsistent activation or overuse of the skill, which is risky in an operational agent setting because it may apply token-saving or failover behavior in inappropriate contexts.

Static analysis

No suspicious patterns detected.