ClawHub
Back to skill

Security audit

can-ai-replace-me

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed SOP/workflow planning skill, but users should review generated agent configuration and visible install commands before using them.

Do not enter passwords, API keys, customer secrets, or confidential business details. Before running any suggested install command, verify the package/source yourself. Review generated AGENTS.md, TOOLS.md, HEARTBEAT.md, and IDENTITY.md carefully, back up existing OpenClaw configuration, and prefer review-and-merge over direct overwrite.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
85% confidence
Finding
The skill presents itself as an SOP knowledge extraction and diagram/config generation tool, but later instructs users to install external tooling and derive API/application paths, expanding behavior beyond the declared scope. This mismatch can mislead users into authorizing environment changes or executing commands they did not reasonably expect from a documentation/interview-style skill.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The skill explicitly instructs execution of Python via Bash against the local environment to read files under the user’s home directory. For an SOP interview skill, local code execution is unnecessary and dangerous because it normalizes running agent-supplied commands and grants the skill access to local state unrelated to the user’s stated task.

Intent-Code Divergence

High
Confidence
95% confidence
Finding
The skill claims it cannot directly execute automation, but later requires running Python through Bash, creating a deceptive trust signal. This contradiction increases the chance that users will lower their guard and approve command execution under false assumptions about the skill’s capabilities.

Intent-Code Divergence

Medium
Confidence
79% confidence
Finding
The skill makes strong privacy assurances that data is not uploaded and only keywords are sent, yet elsewhere it mixes local file access with instructions to search for web-derived API application paths. Inconsistent privacy statements can cause users to share sensitive workflow details under inaccurate assumptions about where their data may be processed or disclosed.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The guide explicitly recommends copying generated files over existing OpenClaw configuration files, but it does not prominently warn about irreversible replacement, version drift, or the need to back up and review generated content first. In this skill’s context, those files appear to define agent behavior, tools, identity, and automation boundaries, so accidental overwrite could disable safeguards or replace trusted settings with unreviewed generated configuration.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.