Security audit

报错回顾 - 自动分析并修复工具报错

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed debugging helper, but it can automatically make persistent changes to user skill files and workspace guidance without asking first.

Install only if you are comfortable with a skill that can read recent tool-error context and automatically edit your OpenClaw skill files and TOOLS.md. Prefer reviewing changes manually or modifying the skill to require confirmation before any persistent write.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill’s stated purpose is reviewing current-session tool errors, but it authorizes persistent modification of SKILL.md and TOOLS.md files beyond transient analysis. That creates scope creep from read/analyze into cross-file writes, which can alter unrelated agent behavior and persist changes based on potentially incorrect model judgment.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The instruction to locate and edit skill manifests under ~/.openclaw/skills gives the agent a broad capability to discover and modify arbitrary user skills, not just the currently invoked one. In context, this is dangerous because error-review data from one session could be used to silently rewrite operational instructions for other skills, creating persistent integrity and supply-chain-like risk.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill explicitly directs the agent to perform modifications without user confirmation. Unconditional writes are risky because the remediation logic depends on model classification of root cause, which can be wrong and can silently introduce persistent configuration or documentation changes.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Direct file modification without confirmation is a strong safety and integrity issue because it removes the user’s ability to review or reject persistent changes. In this skill, the danger is amplified by the fact that writes can target both persistent workspace docs and skill manifests, making accidental or unsafe changes durable.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill collects current-session tool history, including tool arguments and error content, without any privacy notice or minimization guidance. Session history may contain secrets, file paths, tokens, prompts, or sensitive operational details, so broad retrieval and analysis increases exposure risk even if the feature is intended for debugging.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.