Security audit

OtterKit

Security checks across malware telemetry and agentic risk

Overview

This skill and plugin do expose configured local services or webhook endpoints publicly, but the behavior is clearly disclosed, purpose-aligned, and user-configured.

Install only if you intend to use OtterKit to create public webhook endpoints or expose selected local ports. Review the configured ports and subdomains, use authentication for direct tunnels, keep OpenClaw hook tokens enabled, prefer the capture-and-relay mode when possible, and stop endpoints when public access is no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrases are overly broad for a capability that exposes local services to the public internet. Phrases like "tunnel," "expose," and especially "share my localhost" can cause the skill to activate in casual or ambiguous contexts, increasing the chance that an agent helps publish a sensitive local service without a deliberate, security-aware user decision.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill prominently explains how to expose a local port and gateway but does not provide a clear upfront warning that this creates public internet access to the target service. In this context, omission of that warning is dangerous because users may not realize they are publishing development servers, admin interfaces, or webhook handlers beyond localhost.

VirusTotal

61/61 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: relay.mjs:7
Evidence: const url = process.env.OTTERKIT_WAKE_URL;