Security audit
Browser Web Search
Security checks across malware telemetry and agentic risk
Overview
This skill is transparent and heavily gated, but it can let a third-party package operate inside your logged-in browser sessions.
Install only if you are comfortable trusting and auditing the pinned browser-web-search package. Keep BWS_PUBLIC_ONLY=1 unless authenticated access is truly needed, use a dedicated OpenClaw browser profile, close unrelated tabs before sensitive calls, run --dry-run first, and periodically review ~/.bws/audit.log and ~/.bws/consents.json.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.