Security audit

Huo15 Openclaw Bootstrap

Security checks across malware telemetry and agentic risk

Overview

The skill is an onboarding helper, but it asks the agent to copy shared memory that may include credentials, persist profile data outside the workspace, and modify/delete workspace files through broad triggers.

Install only if you are comfortable with an onboarding skill changing workspace identity files and completing bootstrap state. Before running it, ask the agent for a dry run, skip MEMORY.md copying unless you have reviewed the source file for secrets, skip or delete the ~/knowledge/huo15/profile backup if you do not want cross-workspace persistence, and prefer renaming BOOTSTRAP.md over deleting it if you want rollback.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The README frames the skill as onboarding the current OpenClaw workspace, but it also documents writing a profile backup to `~/knowledge/huo15/profile/...`, which is outside the workspace boundary. That creates a scope-expansion and data-minimization issue because users may disclose personal preferences assuming changes remain local to the current project.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: A cross-workspace archival feature is not necessary for basic bootstrap/onboarding and increases persistence of user profile data beyond the immediate task. Persistent profile copies can later be read by other tools, reused in unintended contexts, or expose sensitive preferences across projects and devices.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill advertises a narrowly scoped onboarding flow that creates the 5 workspace files, but the body also instructs copying/appending MEMORY.md and writing a profile backup outside the workspace. That scope expansion is risky because it causes additional persistence and data propagation beyond what a user would reasonably expect from a bootstrap skill.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: This section directs the agent to copy or append a global MEMORY.md into the current workspace, explicitly mentioning shared organizational data and credentials. That creates a clear confidentiality risk because sensitive information can be replicated into more contexts, exposed to later sessions, or mixed with unrelated user workspaces.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The optional L3 backup writes profile data to ~/knowledge/huo15/profile outside the current workspace, extending persistence across devices or workspaces. Even if framed as optional, it stores user profile information in an additional location not necessary for basic onboarding, increasing privacy and retention risk.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The skill states it only writes five files and does not manage MEMORY.md, but later instructions contradict that by copying/appending MEMORY.md and creating an L3 backup. This inconsistency is dangerous because it undermines informed consent and can conceal broader data handling than the user or reviewer expects.

Vague Triggers

High

Confidence: 96% confidence
Finding: Using generic greetings and common words like '你好', 'hello world', or '初始化' as triggers makes accidental activation likely during normal conversation. In a skill that writes files and deletes `BOOTSTRAP.md`, unintended invocation can cause unauthorized workspace modifications and persistent profile changes.

Vague Triggers

High

Confidence: 97% confidence
Finding: The usage section reinforces activation by very broad phrases, increasing the chance that ordinary greetings or exploratory chat will run a state-changing workflow. Because the skill modifies five files and removes a marker file, accidental invocation can alter the workspace without informed intent.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Deleting `BOOTSTRAP.md` is a meaningful state change because it marks onboarding completion and affects future behavior, yet the skill description does not foreground this as a warning. Users may not realize the workflow removes a file automatically, which undermines informed consent and safe change management.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README describes writing profile information to a home-directory knowledge base but does not present a prominent privacy warning where users first learn about the skill. Storing identity, roles, preferences, and other metadata in a persistent cross-workspace location raises confidentiality and retention concerns if users are not clearly informed.

Vague Triggers

High

Confidence: 92% confidence
Finding: The alias and trigger list includes broad phrases like 'hello world', 'onboarding', 'welcome', and '初始化', which overlap with ordinary conversation and non-administrative requests. Because this skill performs file writes and deletion, accidental activation can cause unintended modifications to the workspace.

Vague Triggers

High

Confidence: 93% confidence
Finding: The trigger section reiterates ambiguous activation conditions using common greetings and generic setup language. In the context of a skill that writes files, backs up data, and deletes BOOTSTRAP.md, broad triggers materially increase the chance of unintended execution.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This workflow instructs multiple writes, backups, and deletion of BOOTSTRAP.md, but the user-facing flow does not prominently warn that files will be modified or removed. Without a clear warning and confirmation, users may not realize the skill changes persistent state rather than merely collecting preferences.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The file states that Chinese users should be defaulted to Asia/Shanghai unless they explicitly change it, which applies locale-based inference without prior opt-in. This can mis-handle users in other regions, reveal assumptions about nationality/location, and cause downstream errors in timestamps, date parsing, and scheduling behavior during onboarding.

Ssd 3

High

Confidence: 98% confidence
Finding: The optional shared-memory workflow explicitly encourages transferring global memory that may contain company structure and credentials into the current workspace. That is an unnecessary secret-spreading mechanism for onboarding and significantly increases the blast radius of any later compromise or accidental disclosure.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.