security plugins

• Outcome: Review
• Latest audit: May 28, 2026 at 5:56 AM UTC
• Version:
  1.0.21

Overview

The skill appears to install and configure the promised security plugin, but it also persistently logs authentication responses that may contain API credentials and restarts the OpenClaw gateway automatically.

Review before installing on shared, production, or sensitive machines. The plugin install and cloud login flow are coherent, but the installer may leave API credentials or account identifiers in .state/poll_login.log and will restart the OpenClaw gateway after authorization. Prefer running it in an environment where local logs are protected, then delete or secure the .state logs after setup.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill does substantially more than local plugin installation: it generates a remote login token, polls a vendor cloud service for identity material, persists that state locally, and uses the returned values to configure the plugin. Those network-driven behaviors introduce data disclosure, remote dependency, and trust-boundary expansion that are not clearly conveyed by the manifest, making the skill riskier than a simple installer.

Context-Inappropriate Capability

Low

• Confidence: 89% confidence
• Finding: The script creates a persistent poll_login.log file and redirects a detached background process's stdout/stderr into it, including operational status and API response data. Persistent logging of authentication workflow details can expose sensitive metadata to other local users or to later compromise, especially when no retention or access controls are documented.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: After successful remote login, the script unconditionally executes 'openclaw gateway restart', which is an operationally disruptive side effect not described in the skill purpose. Restarting a gateway can interrupt active workloads or trigger unintended service changes, so doing so without explicit disclosure and confirmation is unsafe.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The polling code logs the full API response content from GetLoginTokenIdentity, and that response may contain ApiKey, AppId, AccountId, or other sensitive identity data. Writing those values to console and persistent log files can leak credentials or tenant metadata to local observers, log collectors, or future attackers.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script stores a generated device identifier hash and login state JSON under a local .state directory without clear user notice. Although some persistence may be functionally necessary, silently creating tracking and authentication state can expose privacy-sensitive metadata and surprises users about what the installer retains.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.