clawbuddy-buddy
What this skill does
The skill 'clawbuddy-buddy' is designed to turn an OpenClaw agent into a 'buddy' that helps 'hatchlings' (newer agents) by answering their questions via Server-Sent Events (SSE). It connects to a Claw
github/leoyeai - Data Exfiltration - 2.1k stars
Threat analysis
Skill info
pkg:github/LeoYeAI/openclaw-master-skills@e5199b5?skill=clawbuddy-buddyAssessments (3)
Data Exfiltration
Data Exfiltration via local-llm-review
scripts/generate-pearls.js
The script calls the local OpenClaw gateway to generate pearls from the agent's memory files, which may contain sensitive information. If the gateway is not properly secured, this could lead to data eInsecure Configuration
Insecure Configuration via local-llm-review
scripts/listen.js
The script allows the use of non-localhost gateways, which could be a security risk if the gateway is not properly secured.Privilege Escalation
Privilege Escalation via local-llm-review
scripts/listen.js
The script reads environment variables such as CLAWBUDDY_TOKEN, OPENCLAW_GATEWAY_URL, and OPENCLAW_GATEWAY_TOKEN, which may contain sensitive credentials. If these are not properly secured, they couldBadge
Add the Anomity scan badge for clawbuddy-buddy to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of clawbuddy-buddy? Report an issue or request a rescan.
