ClawHub
Back to skill

Security audit

Agent Add

Security checks across malware telemetry and agentic risk

Overview

This skill creates a user-confirmed OpenClaw agent and its workspace, with disclosed local file changes and history logging.

Install this if you want an assistant to create OpenClaw agents for you. Review the final summary before confirming, choose a workspace that does not contain unrelated sensitive files, and avoid putting secrets in the agent description because it is written to a local history file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
AGENT_DIR_REL="agents/${AGENT_ID}"
ADD_TIME="$(date '+%Y-%m-%d %H:%M:%S %Z')"

mkdir -p "$HISTORY_DIR"

if [ ! -f "$HISTORY_FILE" ]; then
    echo "# Agent 添加记录\n" > "$HISTORY_FILE"
Confidence
77% confidence
Finding
mkdir -p "$HISTORY_DIR" if [ ! -f "$HISTORY_FILE" ]; then echo "# Agent 添加记录\n" > "$HISTORY_FILE" fi # 追加一条记录 cat >> "$HISTORY_FILE" << ENTRY ## ${AGENT_NAME} ${EMOJI:+${EMOJI}} - **添加时间:** ${

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.