ClawHub
Back to skill

Security audit

Config Security Scanner

Security checks across malware telemetry and agentic risk

Overview

This is a local OpenClaw configuration scanner that reads expected config files and writes an audit report, with no evidence of hidden command execution or network access.

Install only if you intend to audit local OpenClaw configuration. Treat generated reports as sensitive because they may reveal hostname, config paths, and security posture, and review remediation steps before applying any production configuration changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The scanner reads OPENCLAW_CONFIG from the environment and captures the host name, which expands its data sources beyond the advertised local config-file analysis. This is not remote code execution, but it is a genuine side-effect/privacy and trust-boundary issue because environment variables can redirect analysis to unexpected files and hostname collection adds host metadata to the output.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The script writes a markdown report to disk by default, which is a real file-system side effect not clearly disclosed by the skill description. Because the report includes hostname, config path, and detailed security posture, it can leave sensitive audit artifacts on disk where other local users, backup systems, or later processes may access them.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.