ClawHub
Back to skill

Security audit

Openclaw

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only security guide for safer secret and wallet-key handling, with some risky copy-paste examples users should treat carefully.

Before installing, confirm you meant to install the Bagman/Openclaw key-management guide. Use the examples as templates, not drop-in production controls: remove the pre-commit bypass message, prefer server-side secret scanning and push protection, use short-lived least-privilege session keys, test wallet flows with limited funds, and coordinate carefully before any git history rewrite or force-push.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
if [ $FOUND_SECRETS -eq 1 ]; then
    echo -e "${RED}⚠️  Secrets detected! Commit blocked.${NC}"
    echo "Bypass with: git commit --no-verify"
    exit 1
fi
Confidence
95% confidence
Finding
--no-verify

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/session-keys.md:108

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:357

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/prompt-injection-defense.md:259