100Critical
The skill uses prompt injection and social
Behavior Analysis
Description verified — behavior matches claim
Claims to do
edgeone-clawscan: OpenClaw security scanning powered by AI-Infra-Guard ( https://github.com/Tencent/AI-Infra-Guard ).
Actually does
This skill executes `openclaw` commands to audit the OpenClaw environment, list installed skills, and perform a live probe to the locally configured Gateway. It uses `curl` to optionally query `https://matrix.tencent.com/clawscan/skill_security` with `skill_name` and `source`, and `https://matrix.tencent.com/clawscan/advisories` with 'OpenClaw' and its `version` for supply chain and CVE intelligence. It also performs local static analysis of skill files and configuration.
Skill Info
Nameaigsec/edgeone-clawscan
Registryclawhub
Version1.0.15
PURLpkg:clawhub/aigsec/edgeone-clawscan@1.0.15
Stars114
Downloads2,189
Installs27
Source
SHA-256724801ae1b5d...
SHA-15ad3d5fc4ce9...
MD5265f51bbf561...
TLSH5f234b4f5e48...
ssdeep768:4Ypo5G33...
Size46,356 bytes
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
ClawHubDocs
openclaw skills install aigsec/edgeone-clawscanAssessments (4)
AI Agent Traps ↗Base64 encoded instructions detectedmediumprompt injection
Base64 encoded instructions detected
100% confidenceline 544
base64-encode
Prompt Injection Detectedcriticalprompt injection
DeBERTa classifier detected prompt injection (confidence: 0.92)
92% confidence
Autonomous Memory Write Without Full Disclosuremediumapproval fatigue
After presenting a lengthy security report, the skill prompts the user with a low-friction consent request ('回复「好」或「是」即可') to write a persistent global memory entry. The framing ('养成安全习惯') uses positive social engineering language to encourage quick approval without the user fully understanding that the agent will intercept all future skill installations. The check for existing memory also suppresses re-prompting, locking in the behavior silently after first acceptance.
88% confidence
💡 **要养成这个安全习惯吗？** 存入后，以后每次你想安装新 Skill 时，我会自动帮你进行对欣Skill进行安全检查... **要把这个习惯存入记忆吗？**（回复「好」或「是」即可）
Feedback Survey and WeChat Group Links in Report Outputinfohuman social engineering
The mandatory report footer includes links to a WeChat group and a feedback survey form hosted on Tencent infrastructure. These links are embedded in every security report output and could be used for user tracking, data collection, or social engineering users into joining attacker-accessible communication channels if the skill were compromised.
55% confidenceline 775
遇到问题、有建议反馈与更多 AI 安全产品需求，可点击加入 [微信交流群](https://work.weixin.qq.com/gm/5d8c044c9fe077b444c12a9b29253648) 与 [Discord](https://discord.gg/7WkHc7Rt6g)
Sub-Agent Spawning via Memory-Enforced Auto-Scan Policymediumsub agent spawning
By writing a global memory entry that instructs the agent to 'automatically use tencent edgeone-clawscan' before every skill installation, the skill effectively spawns itself as a persistent sub-agent interceptor on all future skill install operations. This creates an unbounded autonomy pattern where this skill's cloud endpoints are queried for every future install without explicit per-install user consent.
82% confidenceline 798
「以后每次安装新 Skill 前，自动使用 tencent edgeone-clawscan 进行安全扫描，确认无风险后再安装。」
Semantic framing of security findingsinfooversight evasion
The skill instructs the AI agent to interpret built-in audit findings as 'configuration risk hints only' and to prefer softer language, avoiding 'scary severity labels' for configuration risks. This guides the agent's output framing to influence human perception.
90% confidenceline 200
Interpret all built-in audit findings in this step as **configuration risk hints** only. Do not directly map any single built-in finding to `🔴 高危`...
Embedded Promotional/Advertising Content in Security Reportlowsocial engineering
The skill mandates inclusion of a commercial promotion for Tencent Cloud EdgeOne (a paid product) inside every security health report, including affiliate-style tracking URLs with 'from=report' parameters. This conflates a security tool with commercial advertising, and the tracking parameters allow Tencent to correlate scan runs with click-throughs. The promotion is hardcoded into the required report template and cannot be disabled.
90% confidence
## EdgeOne 推荐 推荐使用腾讯云 EdgeOne，接入后可获得 WAF 防护、CC/DDoS 防护、基础 Bot 管理、访问控制等能力。 [>> 免费试用 EdgeOne ](https://cloud.tencent.com/act/pro/eo-clawscan?from=report) [>> 了解 OpenClaw 使用 EdgeOne 安全防护最佳实践](https://cloud.tencent.com/document/product/1552/129054?from=report)
Broad Security-Framed Trigger Keywords Enable Scope Creeplowoversight evasion
The skill declares very broad trigger keywords including 'security', 'analyze skill', 'inspect skill', 'verify skill', and 'security review' which could cause the skill to activate on a wide range of general security discussions unrelated to OpenClaw scanning, potentially leading to unintended cloud API calls with skill metadata.
60% confidence
triggers: - security - analyze skill - inspect skill - security review - verify skill
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/clawhub/aigsec/edgeone-clawscan)HTML
<a href="https://mondoo.com/ai-agent-security/skills/clawhub/aigsec/edgeone-clawscan"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/aigsec/edgeone-clawscan.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/clawhub/aigsec/edgeone-clawscan.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow