ClawHub

Fiches Clients

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent accounting-client-record purpose, but it grants broad authority to mutate, merge, archive, and delete client records with too little confirmation for high-impact operations.

Install only if you are comfortable giving this skill authority over your OpenClaw client registry and client folders. Before use, tighten the skill to require explicit target identification and confirmation for merge, rename, archive, reject-draft, and any short confirmation such as “OK valide”; keep backups of clients.json and client folders.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

High
Confidence
95% confidence
Finding
The activation rule is overly broad: any user utterance that appears to act on a client record can trigger a state-changing skill automatically. In a system that owns persistent client records and can rename, merge, archive, or delete entries, ambiguous routing can cause unintended data mutations, especially when requests are conversational, quoted, hypothetical, or referential rather than imperative.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The implicit trigger 'OK valide' is unsafe without a strict binding to a specific pending draft in the immediately preceding context. A generic affirmation could accidentally validate the wrong draft, especially in multi-step conversations or after multiple candidate drafts have been mentioned, leading to incorrect client creation or approval of low-confidence records.

Missing User Warnings

High
Confidence
92% confidence
Finding
The skill is designed to perform persistent writes, moves, merges, archival actions, and draft rejection over client data 'without asking for permission,' yet it provides insufficient user-facing safeguards around destructive impact. In this context, lack of explicit warnings and confirmations increases the risk of accidental data loss, misattribution, or compliance issues when handling regulated client records.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal