Back to skill
Skillv1.0.0
ClawScan security
Skill Sandbox · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousMar 6, 2026, 10:24 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill mostly does what it says (stage, scan, promote), but several claims and safeguards are misleading or incomplete—most notably it is not a true sandbox, it invokes external tooling and network installs, and it fails to declare required binaries/dependencies.
- Guidance
- This skill appears to implement a staging-and-scan workflow, but several mismatches mean you should be cautious before using it as your safety guard: 1) It is not a true sandbox — the script runs 'clawhub install', which will perform network installs and may execute target skill install/postinstall hooks on your host. Run this in an isolated VM/container if you want protection. 2) The SKILL.md claims 'no network calls' and 'no external dependencies', which is false: ensure the host has and trusts 'clawhub', 'jq', and standard Unix tools the script uses. 3) The script offers a '--force' flag that bypasses VirusTotal checks—avoid using --force unless you fully trust the publisher. 4) The skill does not declare required binaries or environment variables (e.g., jq, file, clawhub, OPENCLAW_WORKSPACE), so inventory and install those dependencies manually in a safe environment. 5) Prefer running with '--scan-only' first and reviewing the staged files manually (or with an LLM-auditor) before promoting. If you lack a safe sandbox, do not run this on production hosts; instead run it inside an ephemeral VM or container and verify behavior and outputs before trusting automatic promotion.
Review Dimensions
- Purpose & Capability
- concernName/description claim a 'sandboxed' installation pipeline and 'no network calls / no external dependencies', but the script calls an external 'clawhub' installer (which will perform network operations and may run package install scripts) and relies on tools like jq/file/grep. The required binaries/environment are not declared, so requested actions are disproportionate to the metadata.
- Instruction Scope
- concernSKILL.md instructs the agent to run the included shell script which runs 'clawhub install' into a staging dir. That installer can execute a target skill's install/postinstall hooks on the host (not in an isolated container), so the actual runtime behavior can execute arbitrary code outside the intended scan. The script does not create a true sandbox (no chroot/namespace/container), and SKILL.md's 'no network calls' claim is inaccurate.
- Install Mechanism
- okThere is no external install spec for this skill itself (instruction-only with an included script), so nothing is downloaded by the skill at install time. The risk comes from the script invoking external installers (clawhub) at runtime rather than from an installer URL embedded in the skill.
- Credentials
- concernThe skill declares no required env vars or binaries, yet the script expects OPENCLAW_WORKSPACE (optional), and depends on external binaries (clawhub, jq, file, grep, find, sed, mv, rm, etc.) and on network access. It also provides a --force option to bypass VirusTotal flags which can override upstream protections—this capability is powerful and not justified in the metadata.
- Persistence & Privilege
- notealways:false and no autonomous-disable flags—normal. The script can move staged skills into the live skills directory (promote) and will replace existing live skills; that is expected for a promote tool but be aware it can overwrite live skills when invoked with --promote. It does not request persistent platform-wide privileges or modify other skills' configs programmatically.