ClawHub
Back to skill

Security audit

Openclaw Deploy

Security checks across malware telemetry and agentic risk

Overview

This deployment skill is not clearly malicious, but its full backup workflow can package and transfer private OpenClaw configuration, tokens, and chat history without enough guardrails.

Use the clean package unless you intentionally need a full migration. Before creating or sharing a full package, inspect and remove tokens, private conversation history, and workspace data; protect any archive in transit and at rest; verify OUTPUT_DIR points only to disposable build output; and review or replace the NVM install script before running it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The script documents `./start.sh [clean|full] [port]` but actually reads `VERSION` from `$2` and `PORT` from `$3`, meaning the first user-supplied argument is ignored and valid invocations will not behave as documented. This can cause operators to start the wrong container mode or expose the service on an unintended port, which is security-relevant because the `full` mode mounts persistent user data and the script advertises LAN access.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README explicitly promotes use of a 'full' Docker image that includes DreamMoon configuration, Feishu settings, gateway tokens, and conversation records, and also describes exporting and transferring that image to other servers. Packaging and distributing secrets and chat history without prominent warnings, sanitization requirements, or access controls creates a real risk of credential leakage, privacy exposure, and unauthorized reuse of live integrations.

External Script Fetching

Low
Category
Supply Chain
Content
# 安装 NVM
if ! command -v nvm >/dev/null 2>&1; then
    echo "📦 安装 NVM..."
    curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
    export NVM_DIR="$HOME/.nvm"
    [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
fi
Confidence
95% confidence
Finding
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash

Chaining Abuse

High
Category
Tool Misuse
Content
# 安装 NVM
if ! command -v nvm >/dev/null 2>&1; then
    echo "📦 安装 NVM..."
    curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash
    export NVM_DIR="$HOME/.nvm"
    [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
fi
Confidence
98% confidence
Finding
| bash

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.