ClawHub
Back to skill

Security audit

Task Notifier

Security checks across malware telemetry and agentic risk

Overview

Task Notifier’s notification purpose is understandable, but it asks the agent to install and enable a separate unsafe runtime plugin with broad all-agent hook access that is not included in the reviewed skill files.

Read this carefully before installing. The skill documentation itself is not executable, but saying yes to the suggested install can enable a separate runtime plugin with unsafe install flags, persistent plugin allow-listing, lifecycle hooks, and all-agent coverage. Install only if you trust and inspect the runtime plugin package and are comfortable with global task-completion monitoring; use the documented include/exclude filters or avoid the runtime plugin if you want narrower scope.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill tells the agent to react to a very broad trigger phrase ('when the user mentions Task Notifier or notifications') and then check for and offer installation of a runtime plugin. Because 'notifications' is generic, this can cause unsolicited plugin promotion or installation guidance in unrelated conversations, increasing the chance that a user is steered toward installing code with the explicitly unsafe flag. The surrounding reassurances about safety and the instruction to normalize '--dangerously-force-unsafe-install' make this more concerning, not less.

Session Persistence

Medium
Category
Rogue Agent
Content
2. **`agent_end`** — on completion, reads that run's state marker, checks whether OpenClaw's web interface is the active foreground window, and if it's **not** — fires a native desktop notification with sound. Then cleans up.

Works for **all agents automatically** — main agent, subagents, custom agents. No per-agent registration needed. Parallel runs are tracked separately by run/session key so agents do not overwrite each other's state.

## Smart suppression
Confidence
75% confidence
Finding
write each other's state. ## Smart suppression OpenClaw web interface is open → no notification. You switched away → notification fires. Simple. If notifications fire while you are looking at OpenC

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.