ClawHub
Back to skill

Security audit

Skill Recommender Pro

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed OpenClaw skill recommendation helper that lists installed skill names and queries public skill metadata, without hidden persistence or destructive behavior.

Install this if you are comfortable with the active agent seeing your installed OpenClaw skill names and using ClawHub search or inspect commands to prepare recommendations. Review any suggested install commands before running them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger conditions are broad natural-language phrases like 'What skills should I install?' and 'What's missing in my setup?', which can easily appear in ordinary conversation and unintentionally activate the skill. In an agent environment, accidental invocation can cause unexpected enumeration of installed skills and outbound search/inspect requests, expanding the attack surface and potentially leaking environmental context.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.