ClawHub
Back to skill

Security audit

Openclaw Admin Skill

Security checks across malware telemetry and agentic risk

Overview

This is a local OpenClaw administration skill with broad but disclosed operational authority and explicit safety limits around secrets, destructive changes, and external sharing.

Install this only for agents you trust to help administer OpenClaw on your machine. Expect it to run local diagnostics and propose config or service changes; review confirmations carefully before restarts, deletes, token changes, plugin changes, or docs-cache refreshes, and do not allow it to read secret files or private session contents unless you have explicitly narrowed and approved the scope.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill clearly directs the agent to use shell commands extensively, but no explicit permissions declaration is present. In environments that rely on manifest-declared capabilities for enforcement or user awareness, this creates a trust gap where a powerful skill may execute local commands without transparent scoping.

Tp4

High
Category
MCP Tool Poisoning
Confidence
83% confidence
Finding
The advertised purpose is local OpenClaw administration, but the skill also instructs fetching remote documentation and maintaining a local cache/symlink structure. That extra networked behavior broadens the attack surface and can surprise users who expected purely local operations, especially during incident handling on systems containing sensitive config and session data.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The invocation text is very broad and could match routine operational language, causing the skill to activate in more situations than intended. Over-broad triggering is risky here because the skill has shell-level admin guidance and can steer the agent toward sensitive filesystem inspection, config changes, and service operations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.