X Skill Updater

• Outcome: Pass
• Latest audit: Jun 10, 2026 at 8:21 AM UTC
• Version:
  1.2.0

Overview

The skill is a disclosed local updater for OpenClaw skills; its scan and install powers are meaningful but fit the stated purpose and show no deception or exfiltration.

Use this only if you are comfortable with a local updater reading your installed and workspace skill metadata and writing local update reports. Review the report before approving upgrades, especially bulk upgrades, because the upgrade script can replace installed skill code from configured external sources.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script gathers extensive metadata for skills with unknown provenance and persists it to disk in both a report and a pending-sources file. That goes beyond the stated minimum purpose of update checking and can expose locally installed skill inventory, author identifiers, homepage URLs, metadata fields, and directory structure to other local processes or users, creating an information disclosure risk.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script upgrades skills immediately when invoked, including bulk upgrades via --all, despite the skill metadata promising notification and user confirmation before upgrade. In a scheduled or automated context, this can silently install changed code from external repositories, increasing the risk of unreviewed malicious or breaking updates being deployed.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: Broad triggers like '更新skill' and 'skill更新' can match ordinary conversation rather than a deliberate request to run an updater with shell, filesystem, and network capabilities. In this context, accidental activation is more dangerous than usual because the skill may launch scans, generate reports, and prepare upgrade actions over installed and workspace skills.

VirusTotal

62/62 vendors flagged this skill as clean.