Skylv Openclaw Quick Deploy

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  1.0.3

Overview

This OpenClaw deployment helper is mostly coherent, but it asks users to run remote install scripts and expose/start services without enough safety guardrails.

Review before installing or invoking. Prefer downloading and inspecting deployment scripts, pinning to trusted commits or releases, avoiding direct curl-to-bash execution, and securing the gateway with localhost binding or firewall rules, authentication, and HTTPS before exposing it on a VPS.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases are broad enough to match common words like deploy, install, and setup, which can cause the skill to activate in contexts the user did not intend. In an agent environment, unintended activation is risky because it may lead the agent to suggest or execute deployment-related actions with system-changing side effects.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The instructions recommend one-line deployment methods that fetch and execute remote code and then start services, but they do not warn the user about code execution, privilege requirements, persistence, or rollback implications. This is dangerous because users may execute unreviewed scripts that modify the host, install packages globally, and expose services without understanding the trust and security boundaries involved.

VirusTotal

66/66 vendors flagged this skill as clean.