Security audit

Openclaw Mesh

Security checks across malware telemetry and agentic risk

Overview

This skill is a broad P2P AI mesh package, but it also ships an optional Bitcoin payment and admin gateway that is not clearly declared in the main skill manifest.

Install only if you want a full P2P AI mesh package, not just a small connector. Before enabling serving, WAN, DHT, relay, or the gateway, set strong PSK or TrustStore controls, use TLS for any non-local exposure, keep the gateway bound to localhost unless separately hardened, override the Bitcoin wallet and admin token settings, and treat prompts, files, media, memory queries, and tool results sent to peers as data shared outside your machine.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: If the static analysis is accurate, the documented purpose materially understates the actual behavior: running a payment gateway, web portal, API-key management, persistent admin tokens, and unrelated HTTP execution endpoints greatly expands the attack surface beyond P2P mesh connectivity. In a skill that already handles network access, remote delegation, key files, and tool exposure, hidden monetization/admin services could enable unauthorized remote access, credential theft, sensitive data exfiltration, and abuse of local resources.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The architecture documentation substantially expands the skill from mesh connectivity into local inference, multimodal processing, and a payment gateway. In an agent-skill context, unexplained scope expansion increases attack surface, permission creep, and the likelihood that users enable capabilities unrelated to the advertised purpose, which can lead to unexpected data exposure or execution paths.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: A monetization gateway with FastAPI, SQLite, admin endpoints, API-key issuance, and Bitcoin payment handling is far beyond what is required for P2P mesh transport. In this skill context, it is dangerous because it introduces network-facing web services, secret management, financial workflows, and persistent storage that could expose credentials, payment metadata, or create remote abuse paths if enabled.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Hardware detection, local model management, distributed inference, and multimodal processing exceed the justified role of a mesh connector. Within an agent system that may delegate prompts, files, audio, and images to peers, these extra capabilities increase the chance of unanticipated local execution, sensitive media processing, and broader data handling than the user consented to for simple connectivity.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The function claims to determine a LAN-usable local IP address, but it does so by attempting a UDP connect to 8.8.8.8. Even though no full session is established, this still depends on an external Internet-routable address and can trigger unintended outbound network activity, privacy-sensitive telemetry, or failure in restricted environments. In a mesh-discovery skill that already handles LAN/WAN networking and explicit-consent concerns, undocumented external reachability checks are more dangerous because they bypass the expectation of LAN-only behavior.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The portal includes a client-side control to enable WAN remote access for a node, which materially expands the attack surface beyond the stated local/LAN mesh use case. In this skill context, remote delegation and network exposure are especially sensitive because they may permit external access to local tools, prompts, files, or agent capabilities if backend protections are weak or misconfigured.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file’s stated behavior is a Bitcoin payment and API-key monetization gateway, which materially exceeds the declared skill purpose of connecting OpenClaw to local/LAN P2P meshes. In a consent-sensitive networking skill, hidden monetization and key-issuance infrastructure increases attack surface, enables undisclosed remote service exposure, and indicates the package may perform functions users did not authorize or expect.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: This section implements cryptocurrency payment submission, price-oracle retrieval, blockchain verification, and automatic payment processing, none of which are justified by the mesh-connection description. In practice, this introduces sensitive financial workflows, external network calls, and trust in configurable URLs, expanding the risk profile well beyond peer-mesh connectivity and creating opportunities for misuse, misconfiguration, or covert monetization.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This code adds API-key verification, quota accounting, premium skill execution, demo key issuance, admin key management, and WAN node toggling—capabilities unrelated to simple mesh connectivity. Because it can expose services over the network and execute registered skills for authenticated remote clients, the mismatch between declared purpose and actual behavior makes the component more dangerous: operators may enable it without realizing they are deploying a remotely accessible commercial gateway.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The module docstring openly describes a Bitcoin monetization gateway rather than the advertised mesh connector, confirming a strong intent/implementation mismatch. That mismatch is security-relevant because users and reviewers rely on manifests to assess permissions and risk; misleading packaging can cause unsafe deployment of unexpected financial and remote-execution services.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This test file validates a full Bitcoin payment and API-key monetization gateway that is unrelated to the declared purpose of connecting to local/LAN P2P agent meshes. In a security review, such scope divergence is dangerous because it indicates hidden or undeclared capability expansion, including payment handling, privileged admin flows, and remote execution gating via issued keys.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The tests demonstrate Bitcoin payment submission, payment-status tokens, admin confirmation, and API key issuance for access control, none of which are justified by the mesh-connector description. For a skill that already enables LAN/WAN peer interaction and remote delegation, adding hidden monetization and credential-issuance logic increases attack surface and creates opportunities for abuse, unauthorized service exposure, and mishandling of sensitive user data.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The example delegates a user prompt to a remote mesh node and streams results back, but the code only prints a generic status message and does not present an explicit runtime warning that prompt contents are being transmitted off-host. In the context of this skill, delegated traffic may include sensitive prompts or derived data, so users copying this example could unknowingly disclose private information to a peer on the mesh.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The orchestrator forwards `stage_payload` to remote nodes via `delegate_fn`, and that payload includes `input_activation` containing prompt-derived data. In the context of a mesh networking skill whose metadata explicitly says remote traffic may transmit prompts and related artifacts, this creates a real confidentiality risk if the code path is invoked without an explicit consent gate, disclosure, minimization, or trust validation at this layer.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The script performs active peer discovery and then remotely interrogates discovered peers for skills and health information without any runtime consent gate, prompt, or warning. In the context of a mesh-networking skill that can expose prompts, files, memory, media, and tool results to peers, this behavior increases the risk of unintentional network enumeration and metadata disclosure to or about local/LAN systems.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This script sends the provided payload to a mesh peer via delegate/call_stream with no local confirmation, warning, or visibility into what data is leaving the host. In the context of a mesh skill explicitly capable of transmitting prompts, files, memory, media, and tool results to LAN/WAN peers, this creates a real risk of accidental sensitive data disclosure when the script is invoked directly or by automation.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.