ClawHub

Config Guard

Security checks across malware telemetry and agentic risk

Overview

This looks like a legitimate local rollback helper, but it can automatically overwrite OpenClaw configuration and force-restart Gateway with unclear trigger boundaries.

Review before installing. Use this only if you intentionally want a script that can replace your active OpenClaw config from the latest backup and force-restart Gateway. Keep it manual unless you explicitly configure background monitoring, and check that your backups are current before running it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The documentation makes conflicting claims about execution scope: it says the rollback runs only when explicitly invoked, but also states the skill primarily runs as a background watchdog. This can mislead users about persistence and monitoring behavior, which is security-relevant because background execution changes trust assumptions, resource usage, and the likelihood of unexpected automated restoration or restarts.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill describes automatically restoring configuration files and restarting the Gateway service without prominently warning the user that it will modify files and bounce a service. Undisclosed state-changing behavior is dangerous because operators may trigger disruptive actions unintentionally, causing outages, overwriting intended changes, or losing forensic context during troubleshooting.

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal