ClawHub

OpenClaw Swarm Layer

Security checks across malware telemetry and agentic risk

Overview

This workflow orchestration plugin does run and supervise project tasks, but the reviewed artifacts match that purpose and did not show hidden exfiltration or destructive behavior.

Install only if you want an OpenClaw plugin that can orchestrate project tasks and persist workflow history. Keep autopilot disabled or manual-review-only for sensitive work, avoid syncing reports to Obsidian unless that vault is appropriate for project details, and only configure ACP/plugin paths from trusted sources.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code writes a detailed workflow report to disk containing task, run, session, and autopilot details, and optionally duplicates it to an Obsidian path. This can expose operational metadata, summaries, and potentially sensitive user/project context to local users, backups, sync tools, or other integrations if report storage is not explicitly controlled and disclosed.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code resolves and later imports a service module from configurable plugin install paths, including cfg.plugins.installs.acpx.installPath and user-writable extension locations. If an attacker can influence configuration or place files in those paths, they can achieve arbitrary code execution in the bridge process because the selected module is dynamically imported without trust validation, signature checks, or path restrictions.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly states it generates status snapshots, run logs, review logs, spec archives, and completion summaries to local disk and optionally syncs them to Obsidian, but it does not prominently warn users that workflow content may be persisted outside the immediate session. In an orchestration skill that may process sensitive project specs, task descriptions, and agent outputs, silent persistence increases the risk of unintended disclosure, long-term retention, or syncing sensitive data into a broader note vault.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The installation instructions direct users to install packages from ClawHub, npm, and GitHub, which involves external downloads and execution of third-party code, but the document does not clearly warn about supply-chain or trust implications. While common for installation docs, this is still a security-relevant omission because users are encouraged to fetch and build remote code without guidance on verifying source integrity, version pinning, or reviewing package trust.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
await this.stateStore.saveWorkflow(input.projectRoot, reviewResult.workflow);
                            finalWorkflow = reviewResult.workflow;
                        }
                        increments.autoApproveCount += reviewResult.counts.autoApproved;
                        increments.retryCount += reviewResult.counts.retryQueued;
                        increments.escalationCount += reviewResult.counts.escalated;
                        const sessionStore = new SessionStore(this.stateStore.config);
Confidence
85% confidence
Finding
autoApprove

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
await this.stateStore.saveWorkflow(input.projectRoot, reviewResult.workflow);
                            finalWorkflow = reviewResult.workflow;
                        }
                        increments.autoApproveCount += reviewResult.counts.autoApproved;
                        increments.retryCount += reviewResult.counts.retryQueued;
                        increments.escalationCount += reviewResult.counts.escalated;
                        const sessionStore = new SessionStore(this.stateStore.config);
Confidence
85% confidence
Finding
autoApprove

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
? `synced ${syncResult.results.length} active run${syncResult.results.length === 1 ? "" : "s"} (${transitionedCount} transition${transitionedCount === 1 ? "" : "s"})`
                                : `synced ${syncResult.results.length} active run${syncResult.results.length === 1 ? "" : "s"}`);
                        }
                        if (reviewResult.counts.autoApproved > 0) {
                            summaryParts.push(`auto-approved ${reviewResult.counts.autoApproved} review task${reviewResult.counts.autoApproved === 1 ? "" : "s"}`);
                        }
                        if (reviewResult.counts.retryQueued > 0) {
Confidence
87% confidence
Finding
autoApprove

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
: `synced ${syncResult.results.length} active run${syncResult.results.length === 1 ? "" : "s"}`);
                        }
                        if (reviewResult.counts.autoApproved > 0) {
                            summaryParts.push(`auto-approved ${reviewResult.counts.autoApproved} review task${reviewResult.counts.autoApproved === 1 ? "" : "s"}`);
                        }
                        if (reviewResult.counts.retryQueued > 0) {
                            summaryParts.push(`re-queued ${reviewResult.counts.retryQueued} rejected review task${reviewResult.counts.retryQueued === 1 ? "" : "s"}`);
Confidence
87% confidence
Finding
auto-approve

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
: `synced ${syncResult.results.length} active run${syncResult.results.length === 1 ? "" : "s"}`);
                        }
                        if (reviewResult.counts.autoApproved > 0) {
                            summaryParts.push(`auto-approved ${reviewResult.counts.autoApproved} review task${reviewResult.counts.autoApproved === 1 ? "" : "s"}`);
                        }
                        if (reviewResult.counts.retryQueued > 0) {
                            summaryParts.push(`re-queued ${reviewResult.counts.retryQueued} rejected review task${reviewResult.counts.retryQueued === 1 ? "" : "s"}`);
Confidence
87% confidence
Finding
autoApprove

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
: `synced ${syncResult.results.length} active run${syncResult.results.length === 1 ? "" : "s"}`);
                        }
                        if (reviewResult.counts.autoApproved > 0) {
                            summaryParts.push(`auto-approved ${reviewResult.counts.autoApproved} review task${reviewResult.counts.autoApproved === 1 ? "" : "s"}`);
                        }
                        if (reviewResult.counts.retryQueued > 0) {
                            summaryParts.push(`re-queued ${reviewResult.counts.retryQueued} rejected review task${reviewResult.counts.retryQueued === 1 ? "" : "s"}`);
Confidence
87% confidence
Finding
autoApprove

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
workflow: nextWorkflow,
        decisions,
        counts: {
            autoApproved: decisions.filter((decision) => decision.decision === "approve").length,
            retryQueued: decisions.filter((decision) => decision.decision === "reject" && decision.finalStatus === "ready").length,
            rejectedBlocked: decisions.filter((decision) => decision.decision === "reject" && decision.finalStatus === "blocked").length,
            escalated: decisions.filter((decision) => decision.decision === "escalate").length,
Confidence
94% confidence
Finding
autoApprove

VirusTotal

66/66 vendors flagged this plugin as clean.

View on VirusTotal