ClawHub
Back to skill

Security audit

Openclaw Godot Skill

Security checks across malware telemetry and agentic risk

Overview

This skill openly enables AI control of a Godot editor, including risky project changes, but the reviewed artifacts disclose that purpose and do not show hidden or malicious behavior.

Install only if you want OpenClaw to control a Godot project. Use version control or backups, keep local bridge ports bound to localhost, do not expose them on shared or public networks, and manually confirm deletes, saves, scene edits, input simulation, and screenshot/script-reading actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The README explicitly markets the skill for remote use 'from anywhere,' which broadens the expected operating context beyond the safer 'trusted local projects' scope described in the metadata. For a skill that can control the Godot Editor and perform destructive actions, encouraging remote usage increases the chance of operation against less-trusted environments, accidental misuse, or exposure through remotely reachable setups.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The godot_execute tool forwards arbitrary editor commands to any connected Godot session and explicitly supports destructive actions such as node deletion, scene modification, and save-affecting operations, but it performs no confirmation, policy check, or allow/deny gating before queueing the command. In this skill’s context, the plugin is intended to control a trusted local editor, which lowers remote-exploit severity somewhat, but it still creates a real risk of unintended or unauthorized project-state changes if an agent, prompt injection, or mistaken tool invocation issues destructive commands.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.