Huo15 Openclaw Enhance

• Outcome: Review
• Latest audit: Jun 25, 2026 · 8:29 PM UTC
• Version: 6.7.21

Overview

This appears to be a real OpenClaw enhancement plugin, but it enables a broad set of memory, file sharing, prompt-hook, local scanning, and task-dispatch behaviors that are not fully reflected in the narrow top-level description.

Install only if you want a broad always-on OpenClaw enhancement suite, not just an upload-loop fix. Review and disable modules you do not need, especially ccBridgeKeywordDispatch, sessionBridge, nativeMemorySurfacer, botShare/botUpload, configDoctor, hookProfiler, workflows, and lifecycle memory features. Avoid running the setup or LaunchAgent scripts unless you accept persistent instruction-file changes or scheduled execution, and treat memory export and upload/share links as sensitive data paths.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (73)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises no declared permissions while its documented behavior spans file access, network services, shell/CLI generation, and persistent local state. That mismatch removes an important trust boundary for reviewers and users, making it easier to smuggle powerful capabilities into an apparently low-risk plugin and increasing the chance of unsafe deployment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The top-level description presents the plugin as a narrow fix for an upload-loop issue, but the body documents a much broader platform with memory persistence, HTTP endpoints, file-sharing/upload bridges, prompt injection hooks, shell-oriented workflows, and skill installation/recommendation features. This is dangerous because users may authorize or install it under false assumptions, while the actual attack surface includes multiple privileged behaviors and externally reachable components.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The plan claims the skill is a non-intrusive enhancement focused on upload-flow fixes, but the documented roadmap expands into memory integration/export and persistent workflow management. This mismatch increases the risk of hidden scope creep: operators may enable the skill expecting limited behavior while it gains access to broader user context and persistence features than justified by the stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Exporting all memories as JSON is a high-risk data exfiltration capability, especially in an agent plugin that already maintains persistent memory. Even if intended for backup or synchronization, a bulk export tool can expose sensitive prompts, user data, internal notes, or credentials if invoked improperly or accessed by another component.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Persistent workflow task creation, update, deletion, and storage are outside the narrowly declared upload-enhancement purpose and introduce stateful behavior that can accumulate user/task data over time. This broadens the trust boundary and can create unintended data retention, manipulation, or cross-session influence risks if users are unaware the plugin maintains persistent task state.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The SOP explicitly instructs reverse-engineering and extracting a third-party desktop application's packaged code to derive implementation details. Even if framed as research, this normalizes acquisition and reuse of proprietary internals and can expose the agent workflow to legal, licensing, and supply-chain risk if copied into production code.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill metadata describes a narrowly scoped upload-loop fix, but the entrypoint imports and prepares registration for a large, multi-capability plugin suite spanning memory, workflow, tasking, session bridging, installers, and external bridges. This scope mismatch is dangerous because it can hide materially expanded privileges and behavior from reviewers and operators, increasing the chance that risky capabilities are approved under false expectations.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The user-facing plugin description advertises five core enhancement areas, but the registration list includes many additional behaviors such as skill installation, transcript search, session bridging, upload/share links, diagnostics, archiving, and external dispatch features. In a security-sensitive plugin ecosystem, understated capability disclosure weakens informed consent and can mask broader access than administrators expect.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Registering a skill installer adds a capability to modify the local skill environment, which is materially more powerful than the manifest's stated purpose of non-invasive enhancement and upload guidance. Even if intended as convenience, installer functionality expands the trust boundary and can lead to unreviewed code being pulled into the agent environment.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The 蓝火 dispatch/integration modules introduce external service interaction and, by comment, direct HTTP POST-based task dispatch that bypasses normal LLM decision flow. This is substantially outside the advertised upload-guidance scope and is risky because hidden external execution or data transfer paths can be enabled without reviewers realizing the plugin can trigger off-box actions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script writes a LaunchAgent plist into ~/Library/LaunchAgents and explicitly loads it with launchctl, establishing scheduled persistence outside the plugin's claimed 'non-intrusive enhancement' scope. Even if framed as user-invoked maintenance, this creates a persistent scheduled execution mechanism that can run code later without a fresh prompt, which is security-relevant for an agent skill.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The comments say the script does not perform launchctl load in plugin runtime, but the code later does execute launchctl load on the generated plist. This mismatch is dangerous because it conceals persistence behavior from reviewers and users, reducing informed consent and making security review harder.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The installer performs materially broader changes than the stated purpose suggests: it copies multiple skills into the workspace and modifies persistent workspace content. In an agent/plugin ecosystem, broad undisclosed installation behavior increases supply-chain and trust-boundary risk because users may approve a narrowly described fix while silently receiving new capabilities and prompts that alter agent behavior.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The completion output advertises broad feature areas such as memory, safety logging, workflow automation, and a dashboard that are not reflected in the narrow skill description. This mismatch is dangerous because it signals undeclared functionality and can normalize over-privileged plugin installation in a context where agent behavior and data handling are sensitive.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script patches core workspace instruction files such as AGENTS.md and SOUL.md by appending content, which can permanently alter agent policy, behavior, and trust assumptions. In this skill context, modifying instruction sources is especially sensitive because it can change how the agent handles future prompts, tools, and safety constraints beyond the claimed upload-flow fix.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This module goes beyond diagnosing the user's OpenClaw config and recursively inventories installed plugin directories, package manifests, and source entry files. In a plugin advertised as a non-invasive upload-flow enhancement, this materially expands access to local code and metadata, creating an unnecessary privacy and trust-boundary violation even though the current implementation is read-only.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code reads and regex-scans other installed plugins' source files to detect patterns like async register and legacy tool fields. Inspecting unrelated plugins' code is not justified by the stated upload-enhancement purpose and exposes potentially sensitive proprietary code or secrets embedded in local plugin files to this skill's logic surface.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The header claims the module only reads openclaw.json and is non-invasive, but the implementation also reads package.json, openclaw.plugin.json, and plugin entry source files from all installed plugins. This mismatch is security-relevant because it misleads reviewers and users about the plugin's actual filesystem reach, undermining informed consent and detection of over-privileged behavior.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The module registers an `enhance_memory_export` tool that serializes up to 1000 stored memories and returns the full JSON payload directly to the model/user context. This materially expands the plugin from passive memory supplementation into bulk data exfiltration capability, which is out of scope for the stated upload-flow enhancement and increases the risk of exposing sensitive long-term memory contents if the tool is invoked accidentally, socially engineered, or misused by the model.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This code adds a knowledge-base style bulk export function unrelated to the described purpose of non-invasive OpenClaw enhancement and upload guidance. Even without network transmission, exposing all stored memories as a single JSON blob creates a clear confidentiality risk because any secrets, personal preferences, project details, or prior context in the memory store can be surfaced wholesale to the conversation.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The header comment says the enhancement is '只读 enhance 自己的 SQLite' and frames the module as non-intrusive, yet the implementation repeatedly calls addChapter and storeMemory in session_start, session_end, before_reset, and subagent hooks. This is an active persistence-and-modification module, not a read-only one, so the documented scope does not match actual behavior.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The '红线遵守' section states '只读 enhance 自己的 SQLite' while also mentioning writes to enhance-owned tables; the implementation confirms the latter by persisting chapters and memories. This is not merely incomplete documentation but an active contradiction between stated intent and executed behavior.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: This module persists per-session token usage, model history, peak context percentage, timestamps, and estimated cost across restarts, which materially exceeds the skill’s declared purpose of fixing upload-loop behavior and guiding post-upload flow. That kind of durable telemetry creates an unnecessary data-retention and profiling surface: even if no direct exfiltration is shown here, it enables long-term tracking of user sessions and agent behavior that could be misused by other code or future changes.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The historical profiling helpers expose agent-level aggregation over past sessions, including average and maximum context usage and monthly cost estimates, which are unrelated to the stated upload-enhancement functionality. In context, these functions increase the sensitivity of the stored telemetry by turning raw session records into operational profiling data that can reveal usage patterns, scale, and spending behavior if accessed by unauthorized components.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This file implements a large, persistent multi-feature data store covering memories, safety logs, pets, notifications, todos, chapters, and scheduled-task bindings, which materially exceeds the skill's declared purpose of upload-flow enhancement and fallback-link loop prevention. That scope expansion increases attack surface, data retention, and the chance of undocumented collection or cross-feature abuse, especially in an agent plugin where users would not expect durable state unrelated to file-upload handling.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/modules/cc-bridge-keyword-dispatch.ts:138