ClawHub
Back to skill

Security audit

OpenClaw Benchmark

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local benchmark that runs bounded timing tests and saves local reports, with no evidence of hidden collection, exfiltration, or destructive behavior.

Install only if you are comfortable with a benchmark that runs simple local commands, makes a couple of outbound web requests, and saves benchmark reports. Do not open reports generated from untrusted metrics JSON, and delete /tmp/bench_metrics.json or ~/Downloads/OpenClaw-Benchmark if you do not want local benchmark history retained.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill instructs the agent to use shell execution for benchmark steps that are not strictly necessary to measure generic model performance. Even though the sample commands are simple and scoped, embedding exec capability into a benchmarking workflow normalizes local command execution and expands the attack surface if the skill is reused, modified, or run in a less restricted environment.

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The HTML report is built with Python f-strings that insert untrusted JSON fields such as test names, model names, system info, and failure text directly into HTML without escaping. If a crafted metrics.json contains HTML or JavaScript payloads, opening the generated report in a browser can trigger stored XSS/local script execution in the report context, which is especially relevant because this tool writes a persistent HTML file intended for later viewing.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The benchmark directs creation and deletion of a local file in /tmp without an upfront warning that the skill will modify the local filesystem. While the specific file path is limited and the action is low-risk, undisclosed write/delete behavior violates the principle of least surprise and could be dangerous if adapted to other paths or copied into similar skills.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill persists benchmark metrics, HTML reports, and baseline JSON files containing system and model metadata such as OS, architecture, versions, skill count, and prompt-token estimates, but does not clearly disclose this retention. Persisting environment metadata can expose operational details useful for fingerprinting or later misuse, especially if the files are shared or committed to source control.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.