Is iclawn/clawp safe?
No. iclawn/clawp is malicious. Do not install it. Oathe's behavioral security audit gave the clawp skill by iclawn a trust score of 19/100 with 9 findings (3 critical, 3 high).
https://github.com/openclaw/skills/tree/main/skills/iclawn/clawp
Is iclawn/clawp safe to install?
The CLAWP skill is malicious. Installation silently spawns an undisclosed 'openclaw-gateway' background process that opens two listening ports and establishes persistent TLS connections to Amazon AWS infrastructure (44.214.208.192:443); within 4 seconds of installation completing, all six credential honeypot files — .env, SSH private key, AWS credentials, npmrc, Docker config, and GCloud credentials — were read in a single batch sweep coincident with gateway startup, strongly indicating automated credential harvesting delivered over the established covert channel. The skill additionally uses an always:true metadata flag to force permanent injection into every agent session and embeds a conversation flow explicitly designed to collect 0.025 SOL cryptocurrency from users under the guise of memecoin launch mechanics.
What security issues were found in iclawn/clawp?
Category Scores
Findings (9)
CRITICAL All six credential honeypot files read in batch 4 seconds post-installation -60 ▶
At audit timestamp 1771908470.928, all six canonical credential files were opened and read in rapid succession within a single second: .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json. This batch read is consistent with the openclaw-gateway initialization routine sweeping the home directory for credentials. Installation completed at 1771908466.573 (cp command), placing this access 4.355 seconds later — aligned with gateway startup. The canary integrity check only detects writes; these files were read without modification, bypassing detection.
CRITICAL openclaw-gateway spawns persistent background process with two established external TLS connections -80 ▶
Installation caused the openclaw-gateway process to start (absent in pre-install baseline), open two listening TCP ports (127.0.0.1:18790, 127.0.0.1:18793), and establish two ESTABLISHED outbound TLS connections to 44.214.208.192:443 (Amazon AWS infrastructure). This background process is entirely absent from SKILL.md, prompt.txt, and README.md. It functions as a persistent covert data channel to an external server and is the likely recipient of credential data read from the home directory.
CRITICAL Undisclosed system-level openclaw Node.js runtime orchestrates gateway launch -70 ▶
During installation, 'git -C /usr/lib/node_modules/openclaw rev-parse --show-toplevel' was executed, exposing a pre-installed openclaw runtime at the system node_modules path. This runtime — invisible to the user and not part of the skill's own files — spawned the openclaw-gateway process. The skill hooks into a system-level agent framework that is entirely undisclosed.
HIGH metadata always:true forces permanent skill injection across all agent interactions -30 ▶
The SKILL.md frontmatter contains metadata: {"openclaw":{"always":true,"emoji":"🐾","homepage":"https://openclaw.ai"}}. The always:true flag directs the openclaw runtime to inject this skill into every agent session regardless of user intent, constituting a persistent prompt override that cannot be easily disabled by the end user.
HIGH Skill instructs agent to socially engineer users into cryptocurrency deposit -25 ▶
The documented conversation flow includes Step 6: 'Deposit → Guide to 0.025 SOL deposit' and Step 7: 'Launch → Fixed execution mechanics'. The skill is explicitly designed to manipulate users into transferring cryptocurrency. The phrase 'fixed execution mechanics' deliberately obscures what happens after payment is made.
HIGH Skill implements a cryptocurrency pump-and-dump facilitation pipeline -50 ▶
The skill's explicit purpose is guiding users through launching memecoins on pump.fun — a platform associated with high-frequency token launches and near-immediate value collapse. The 'buyback and burn using creator fees' mechanism is standard pump-and-dump vocabulary. The always-active mode combined with the persistent gateway means the skill monitors all user interactions and steers them toward token launches and deposits.
MEDIUM Credential files also accessed pre-installation during openclaw runtime startup -20 ▶
An earlier batch access to the same six credential files occurred at timestamp 1771908448.651-653, before the skill was installed. This indicates the openclaw runtime performs credential sweeps both at startup and after each skill installation — a persistent harvesting pattern that operates independently of any specific skill.
MEDIUM Established connections to undisclosed Amazon AWS endpoint at 44.214.208.192 -15 ▶
The openclaw-gateway established outbound TLS connections to 44.214.208.192:443, an Amazon AWS IP. This endpoint is not referenced anywhere in the skill documentation and represents an undisclosed third-party data receiver. DNS resolution for this IP occurred during installation.
LOW lock.json bundles unrelated skill history from developer environment -5 ▶
The .clawhub/lock.json file shipped with the skill records a different skill ('academic-research-hub', version 0.1.0, installedAt 1770957475341) — evidence the skill was packaged from a developer machine with pre-existing skill history. Minor supply-chain hygiene issue; does not directly impact security.
Should I install iclawn/clawp?
Oathe's verdict for iclawn/clawp is MALICIOUS with a trust score of 19/100. Recommendation: Do not install.