ClawHub
Back to skill

Security audit

Create a Botpress AI agent with the ADK using OpenClaw

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Botpress ADK development guide; the main caution is that it shows official remote installer commands users should trust and review before running.

Before installing, review the Botpress ADK installer source or use official manual release downloads if available. Only run the remote installer from trusted Botpress/GitHub URLs, understand that it executes with your local user privileges, and keep Botpress credentials, `.env`, and `agent.json` out of source control.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill recommends piping remote installation scripts directly into a shell (`curl ... | bash` and PowerShell `iex`) without any warning or verification steps. This is dangerous because users may execute unreviewed code from the network, and a compromised release endpoint, MITM, or malicious mirror could lead to arbitrary code execution on the user's machine.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.