Security audit

Clawdbot Security Check

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate security-audit skill, but it claims to be read-only while documenting a fix mode that changes bot settings and file permissions.

Install only if you are comfortable with the skill inspecting local Clawdbot configuration and possibly displaying sensitive configuration values. Treat normal audit use as read-only, but do not run --fix unless you intentionally want persistent changes to bot policies, logging behavior, and file permissions after reviewing and backing up affected files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The README makes a strong safety claim that the skill is '100% Read-only' and 'never modifies configuration', but elsewhere documents a '--fix' mode that changes policies and file permissions. This kind of contradictory documentation can mislead users and reviewers into granting the skill more trust or permissions than intended, increasing the chance of unexpected state-changing actions in a security-sensitive context.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The output example claims 'No changes were made to your configuration' even though the README also documents a '--fix' mode that performs modifications. In a self-auditing security skill, false assurances about non-modification can cause users to miss unauthorized or unexpected changes and undermine safe operational review.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata and description present the capability as a read-only audit, but the content explicitly documents a `--fix` mode that applies configuration and permission changes. This mismatch can cause operators or downstream agents to invoke the skill under false assumptions, leading to unintended state changes on the host.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The skill states both 'No changes were made' and 'This skill only reads; never changes configuration,' yet earlier sections define a `--fix` mode that performs hardening changes. Such contradictory assurances are dangerous because they undermine operator trust boundaries and may cause unintended modification in environments expecting audit-only behavior.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The documented trigger phrases are broad natural-language requests like 'run security check' and 'what vulnerabilities do I have?', without clarifying activation boundaries or requiring strong scoping. In an agent environment, ambiguous trigger language can cause accidental invocation from ordinary conversation or from attacker-controlled content that induces the bot to start a sensitive self-audit workflow.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The README describes a '--fix' mode that changes configuration and file permissions but does not prominently warn that it modifies system state. For a security-focused skill with filesystem access, insufficient disclosure increases the risk of users invoking destructive or disruptive changes under the mistaken belief that they are running a harmless audit.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The invocation examples introduce `clawdbot security audit --fix` as just another audit command, without a nearby, prominent warning that it alters local configuration and permissions. Users or orchestrating agents may treat it as a harmless diagnostic action and trigger state changes unexpectedly.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The top-level description says the skill is a comprehensive read-only security audit, while the body documents a `--fix` mode that changes config and filesystem permissions. This creates a deceptive interface contract: tooling or users selecting the skill for safe inspection may unknowingly enable a mutating capability.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.