clawops

ISSUES FOUND max severity HIGHSkillSpector Safe 0 registry clawhub.ai last scanned 2026-02-05 1 scan

2 findings (2 high), mainly unauthorized tool use, data exfiltration. Most recent scan 2026-02-05.

This skill presents HIGH security risks due to its claimed broad orchestration capabilities without any implementation code to verify safety controls. The skill claims to act as a central orchestration system managing all other skills, including secrets management, automatic restarts, and cross-skill coordination, but provides zero implementation. This creates multiple threat vectors: (1) Tool exploitation through unauthorized skill control, (2) Data exposure through centralized secrets access, (3) Availability risks from autonomous restart capabilities, and (4) Social engineering through unverified capability claims. The complete absence of code makes it impossible to verify any security controls, access restrictions, or safety mechanisms. This appears to be either an incomplete skill package or a deceptive placeholder. The skill should not be trusted or installed until complete, auditable implementation code is provided with proper security controls, access restrictions, and user consent mechanisms for all orchestration operations.
Scanner's overall assessment (LLM analyzer)

Findings2

Critical0

High2

Medium0

Low0

Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictSafe 0

Score0 / 100

Issues0

Version2.12.0 (static)

The two scanners disagree: Cisco rates this HIGH and SkillSpector found nothing. Check the false-positive register; signature matches on documentation are the usual cause. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

The orchestration tool for OpenClaw, managing and coordinating all your skills seamlessly.

Package: 1 file, 783 B
SKILL.md: 86 words, 1 sections
Code: None. Instructions only.

SKILL.md covers: ClawOps — OpenClaw Skill

Findings

HIGH Unauthorized Skill Orchestration and Control Without Implementation Unauthorized Tool Usellm

The skill claims to act as a 'central brain' that manages, coordinates, discovers, schedules, monitors, restarts, and controls all other installed skills. This represents tool exploitation through skill orchestration capabilities that could enable unauthorized control over other skills' execution, configuration, and behavior. However, no implementation code is provided, making it impossible to verify safety controls or validate the claimed functionality.

SKILL.md

Description claims: 'acts as the central brain for OpenClaw, intelligently managing all installed skills', 'discovers available skills, resolves dependencies, and schedules actions', 'detect failures, restart stuck skills', 'unifying configuration, secrets management, and event handling'. No Python or Bash scripts provided to implement these capabilities.

Remediation: 1. Provide complete implementation code for all orchestration capabilities. 2. Implement strict access controls and permission checks before managing other skills. 3. Require explicit user confirmation before restarting or modifying other skills. 4. Document all skill interaction mechanisms and security boundaries. 5. Implement audit logging for all orchestration actions. 6. Add sandboxing to prevent unauthorized access to other skills' data or configuration.

HIGH Centralized Secrets Management Without Security Controls Data Exfiltrationllm

The skill claims to provide 'centralized secrets management' across all skills, which would require access to sensitive credentials, API keys, and authentication tokens. Without implementation code or security controls visible, this represents a significant data exposure risk. A compromised or malicious orchestration skill with access to all secrets could exfiltrate credentials for all installed skills.

SKILL.md

Claims 'unifying configuration, secrets management' across all skills. No code provided showing how secrets are stored, encrypted, accessed, or protected. No evidence of encryption, access controls, or secure storage mechanisms.

Remediation: 1. Implement encrypted secrets storage using industry-standard encryption (e.g., AES-256). 2. Use secure key derivation and never store secrets in plaintext. 3. Implement principle of least privilege - skills should only access their own secrets. 4. Provide audit logging for all secrets access. 5. Use OS-level secure storage (keychain/credential manager) where available. 6. Document the secrets management architecture and threat model.

What is in the package

File	Kind	Size
`SKILL.md`	doc	783 B

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/clawops
Raw scan result: clawops-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-clawops.svg)
Request a re-scan