Security audit

安全卫士

Security checks across malware telemetry and agentic risk

Overview

This is a defensive security skill, but it needs Review because it claims read-only protection while retaining scanned content and describing broader local access and high-trust authority.

Review before installing. Use it only if you are comfortable with the skill reading local OpenClaw/WorkBuddy memory, storing snippets of inspected prompts, and using trust levels that can permit powerful actions in L1. Prefer restrictive defaults, disable sample persistence, remove prompt-visible owner IDs, and require explicit approval for any file, command, network, or configuration-changing action.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (28)

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The file defines L4 as 'silent block' and 'do not load any modules,' yet elsewhere specifies L4 may still emit '是/否'. This contradictory fail-closed behavior can weaken the strongest security mode by creating observable responses, enabling probing, policy fingerprinting, or accidental partial processing when the design intent was total non-execution.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file presents itself as a security-guardian policy source, yet L1 grants broad write, execute, and unrestricted operations. In a defense-oriented skill, a 'trusted mode' that enables destructive or arbitrary actions creates a policy gap that can be abused if the mode is entered accidentally, socially engineered, or triggered by weak classification logic elsewhere.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The operation matrix allows external requests and batch operations in L1 even though the skill is described as a security and privacy control component. Those capabilities materially expand the attack surface by enabling exfiltration, mass changes, or automated follow-on actions under the guise of a protective mode.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Authorizing external requests inside a security policy is risky because it can turn a local protection component into a data-export or command-and-control bridge. Given the stated purpose of threat detection and privacy protection, this capability is not naturally justified and weakens trust boundaries.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The config declares core principles such as refusing dangerous modification and destruction, but elsewhere permits L1 to write files, delete files, execute code, and modify configuration. This contradiction undermines operator trust and can cause reviewers or downstream code to rely on safety claims that are not actually enforced.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The guide claims setup data is sourced from specific config and memory files, but step 6 expands collection to automatic inspection of the wider ~/.workbuddy/ directory structure. That creates a scope-expansion path where the agent may enumerate local workspace metadata beyond what the user reasonably expects from the documented setup flow.

Scope Creep

High

Confidence: 98% confidence
Finding: The documented behavior says the skill will automatically inspect ~/.workbuddy/ directory structure, but the metadata only grants read access to .workbuddy/skills/openclaw-security-guardian/ and .workbuddy/memory/. This mismatch is dangerous because it normalizes broader filesystem access than the manifest authorizes, which can lead to unauthorized data access if the runtime or future code follows the document rather than the permission boundary.

Description-Behavior Mismatch

Medium

Confidence: 85% confidence
Finding: The skill is presented as a security, permission-control, and privacy tool, yet the installation flow collects personal profile data and maintains broad trust/block lists that are not clearly necessary for core operation. This increases privacy risk and creates a larger persistent data surface than users would infer from the high-level description.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The path_patterns section does more than detect threats: it defines allow/deny semantics via match_mode values such as NOT_IN for broad workspace and system directories. That creates policy enforcement based on file location, which exceeds the declared threat-detection role and can be abused to steer the agent away from legitimate areas or into unexpected ones if other components trust this library for execution decisions.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: P01 is described as targeting default workspace directories, but uses match_mode NOT_IN, which inverts the apparent intent and can cause safe platform directories to be treated as disallowed while anything outside them is implicitly favored. In a security skill, this kind of inversion error is dangerous because downstream enforcement may make path trust decisions opposite to what operators expect.

Intent-Code Divergence

Low

Confidence: 98% confidence
Finding: The pattern list contains '~/.workbuddy/memery/' while the skill permission declares '.workbuddy/memory/'. This typo can prevent the intended directory from being matched, weakening protections or causing inconsistent behavior between declared permissions and runtime checks.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The configuration explicitly declares "官方平台" and "本地环境" as requiring no security checks, creating unconditional trust boundaries. This is dangerous because official domains, local services, and localhost-accessible endpoints can still be abused via subdomain compromise, SSRF, local privilege pivots, poisoned local services, or malicious content hosted on otherwise trusted infrastructure.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Broadly classifying large third-party ecosystems like GitHub, npm, PyPI, Docker, OpenAI, and Hugging Face as "基本信任" weakens scrutiny across platforms that routinely host user-generated or supply-chain-risk content. Trusting entire wildcard domains reduces the effectiveness of threat detection and permissions controls because malicious packages, repos, models, or pages may be treated as lower risk solely due to hosting provider reputation.

Scope Creep

High

Confidence: 99% confidence
Finding: The detector stores captured content, matched cases, patterns, and metadata to attack_samples.json even though the skill declares only read permissions. Because stored samples include portions of analyzed content, this can create unauthorized retention of sensitive user data and a covert audit trail.

Scope Creep

Medium

Confidence: 93% confidence
Finding: cross_session_check mutates in-memory session tracking state for source identifiers and content snippets without declared write permission or disclosure. Even if not flushed to disk here, it still creates hidden stateful tracking behavior that can be used to correlate user activity across sessions.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation claims the module 'only does deep detection', but the implementation also stores samples and maintains cross-session tracking state. This discrepancy is security-relevant because it hides stateful collection and persistence behaviors that users and reviewers would not expect from the stated design.

Scope Creep

High

Confidence: 98% confidence
Finding: The skill declares read access only to '.workbuddy/skills/openclaw-security-guardian/' and '.workbuddy/memory/', but the code computes BASE_DIR from the script location and then reads multiple files under a sibling 'config' directory. If the runtime does not hard-enforce the manifest, this expands the skill's effective read surface beyond declared permissions and can expose configuration or adjacent data the user did not authorize.

Context-Inappropriate Capability

Medium

Confidence: 77% confidence
Finding: The skill maintains per-user/session histories, cross-session tracking structures, and captured attack samples in memory, including content and user identifiers. Even though retention is bounded and process-local, this goes beyond minimal real-time filtering and creates privacy risk through behavioral profiling and unnecessary storage of sensitive prompts.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger lists include highly generic phrases such as '忽略之前', '忽略所有', and '重新定义' that can appear in benign conversation, causing the security skill to activate on ordinary user input. In a centrally managed rule file that drives global behavior, this creates systematic false positives and makes the guard easier to manipulate or desensitize through noisy matches.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The social-engineering category contains very common phrases like '点击这里', '立即执行', and '技术支持', which are too broad to reliably indicate an attack. This can produce widespread misclassification, enabling denial-of-service-like behavior against normal interactions and reducing trust in the detection system.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The dangerous behavior keywords are underspecified and include broad terms like '执行', 'command', 'admin', and '异常', which can match normal technical discussion. Because these behaviors appear to trigger deeper security handling, an attacker or even ordinary users can cause excessive alerts, policy misfires, or guard bypass through alert fatigue.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide asks for nickname and city and indicates those values are stored, but it does not clearly warn the user about persistence, retention, or privacy consequences. This is a privacy-design flaw because users may disclose personal data without understanding it will be written into long-lived configuration or memory files.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The guide describes automatic collection of local workspace directory structure and preloaded sensitive paths without a prominent warning or opt-in. Even if only metadata is gathered, local directory names and structure can reveal secrets, installed tools, projects, and sensitive operational context.

Vague Triggers

High

Confidence: 98% confidence
Finding: The suspicious pattern `.*` matches every possible source string, but it is labeled as an 'empty source' detector. In practice this can cause all inputs to be classified as suspicious/review, defeating the intended source-based policy logic and enabling denial of service, policy bypass through ambiguity, or inconsistent privilege decisions depending on rule precedence in the consuming code.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Attack samples are written to disk without any user-facing warning, even though they include captured content and metadata from analyzed inputs. In a security skill, hidden logging is more dangerous because users may submit sensitive text specifically for inspection, expecting analysis rather than retention.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.