Security audit

AgentSentry

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does what it says, but it handles device-linked login material and service configuration in ways users should review before installing.

Review this before installing on a production OpenClaw environment. Expect outbound calls to Volcengine/ClawSentry endpoints, stable device fingerprint transmission, local token state, OpenClaw plugin configuration changes, conversation-access permission for the security plugin, and an automatic gateway restart. Avoid running it where `.state` logs or OpenClaw config files may be exposed to other users until credential redaction, permissions, and cleanup behavior are clarified.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The manifest describes the skill as only performing installation and basic configuration, but later documentation states it also restarts the OpenClaw gateway. This discrepancy can mislead reviewers and users about operational impact, causing unexpected service interruption or broader execution side effects during deployment.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The 'Limited Scope' claim says the script only changes plugin configuration and temporary files, but the documented workflow also includes restarting the OpenClaw gateway. This understates the skill's real behavior and can cause operators to approve execution without understanding that it can disrupt running services.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script does substantially more than local installation/configuration: it enrolls the host with a remote vendor service, creates a device-linked login token, persists login state, and polls the service for identity material. In the context of a skill advertised as plugin installation and basic configuration, this expands trust boundaries and enables undisclosed outbound enrollment and account binding behavior.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code derives a persistent machine identifier via node-machine-id and sends it as an X-Ai-Device-Fingerprint header to remote endpoints. This creates a durable host tracking mechanism and links the installation flow to a specific device without necessity for basic plugin installation.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: After receiving remote identity data, the script restarts the OpenClaw gateway automatically. Restarting a core service changes runtime state and availability, and can disrupt existing workloads or force immediate activation of newly delivered configuration without operator review.

Intent-Code Divergence

Low

Confidence: 77% confidence
Finding: The user-facing phase description says the init phase mainly creates a login URL and exits quickly, but in practice it also removes existing agent-sentry config and installs a plugin before that. This mismatch reduces informed consent and can cause users to approve actions whose side effects are understated.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README instructs users to complete login authorization and then continue with automatic configuration, but it does not disclose what permissions are granted, what data may be accessed, or what configuration changes will be made to the OpenClaw environment. In a security-plugin installation context, this lack of transparency can cause users to approve sensitive access or system modifications without informed consent, increasing the risk of privilege misuse or unintended changes.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The script transmits the machine-derived fingerprint and login-token-related identity requests to vendor endpoints with no user confirmation gate. In a security-plugin installer context, silent transmission of host identifiers and authentication flow metadata is especially risky because users may assume only local setup is occurring.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The script writes login state containing loginToken, deviceFingerprint, loginUrl, and related status to a local JSON file, and logging captures operational details to disk. Storing authentication-linked material and persistent identifiers in plaintext local files increases exposure to local compromise, unintended sharing, or later misuse.

Session Persistence

Medium

Category: Rogue Agent
Content: The skill uses a bundled CommonJS script (`bundle.cjs`) for installation. This script is executed directly and supports two explicit phases: - **Phase 1 (`--phase init`)**: Install plugin, create login token, print the product authorization activation page link, save local state, and return quickly. - **Phase 2 (`--phase finalize`)**: Read the saved state, perform a short polling window, and finish writing OpenClaw plugin configuration if platform login and activation are complete. If the script is run without `--phase`, it automatically chooses:
Confidence: 93% confidence
Finding: Read the saved state

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.