ClawHub

Cache Cleanup

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local cache cleanup tool that deletes old OpenClaw-related files and has no evidence of hidden data theft or deceptive behavior.

Install only if you want automatic removal of old local OpenClaw cache, logs, browser, canvas, sandbox, cron temp files, OpenClaw-named /tmp files, and project .cache directories. Review the hard-coded /root/.openclaw path and consider disabling the cron schedule or adding your own dry-run/exclusions if those locations may contain files you need.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill is explicitly designed to delete files across multiple cache, temp, log, and application-specific directories, but it provides no warning that deletion may be irreversible and no expectation of review, dry-run, or confirmation before cleanup. In this context, users or automations may treat the action as routine maintenance and unintentionally remove files that are still needed, especially in broad paths like /tmp/ and ~/.cache/.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation recommends cron-based unattended execution every 3 days without warning that repeated automatic cleanup can remove files without user review. Because this skill targets broad directories and includes proactive cleanup on high disk usage, automation increases the chance of recurring data loss or disruption if retention rules are too aggressive or misapplied.

Vague Triggers

Medium
Confidence
75% confidence
Finding
The manifest describes broad cleanup behavior like deleting expired cache files, auto-flush files, and old logs, but it does not define what paths, file classes, age thresholds, or safety boundaries apply. In a scheduled skill, vague cleanup scope can enable overly aggressive deletion, accidental data loss, or abuse by an implementation that removes files outside intended temporary locations.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal