Security audit

OpenClaw Hardener

Security checks across malware telemetry and agentic risk

Overview

This hardening skill appears security-focused, but it grants broad local write and command authority with some under-disclosed mutation paths that users should review before installing.

Install only if you are comfortable letting this skill inspect your repository and ~/.openclaw data, run local OpenClaw/git/bash/python commands, and make opt-in changes. Prefer running check mode first in a clean working tree, review config plans manually, and avoid apply-config or fix modes unless you understand the exact changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises and instructs use of filesystem, environment, and shell-capable operations, but it does not declare permissions or an equivalent trust boundary in the skill metadata. That creates a transparency and governance gap: a reviewer or runtime may underestimate the skill's ability to read sensitive files, inspect ~/.openclaw, invoke CLI commands, and potentially modify local state when users run fix/apply modes.

Scope Creep

Medium

Confidence: 96% confidence
Finding: The manifest's expectedWrites claims the skill should only modify ~/.openclaw/**, but the actual filesystem write permission also allows writing anywhere under <repo>/**. That mismatch weakens user and platform trust boundaries because a skill presented as config-hardening could also alter source files, hooks, CI config, or other repository content during execution. In this context, the danger is elevated because the skill also has subprocess access to tools like bash, git, and python3, making broad repo writes more capable of persistence or supply-chain style tampering.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill intent describes broad hardening and security actions across both the workspace and ~/.openclaw without clear activation constraints, scope limits, or trigger examples. Ambiguous security-oriented skills are risky because they can be invoked in more situations than users expect, increasing the chance of unnecessary scanning, modification, or execution of powerful subprocesses against sensitive project content. In this context, that ambiguity is more dangerous because the skill has read/write access to the repo and home configuration plus multiple security and shell tools.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The manifest grants a combination of write access, subprocess execution, and optional network access, but it does not disclose these capabilities in a clear user-facing warning. That creates a consent and transparency gap: a user may invoke a 'hardener' expecting passive analysis while the skill can modify files, execute shell-capable tools, and potentially communicate externally. The context makes this more dangerous because security-audit workflows often inspect secrets and sensitive configs, so undisclosed powerful permissions raise prompt-injection, exfiltration, and destructive-change risk.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The apply-config path performs a live config.patch RPC immediately after computing a patch, without an in-code confirmation gate, dry-run diff acknowledgement, or explicit '--yes' style safeguard. In a security-hardening skill, this is more sensitive because it modifies gateway configuration and could unexpectedly change security-relevant settings or operational behavior if invoked by an automation layer or inattentive user.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.