Security Audit Report

Score: 95/100
Skill Name: qwen-image-plus-sophnet
Status: Safe
Created by: duffycoder
Files: 3
Date: 4/30/2026, 2:47:14 PM

🔭 Continuously monitored by ClawSecure Watchtower

Findings

  • Critical: 0
  • High: 0
  • Medium: 1
  • Low: 0
  • Info: 1

Source: ClawHub Link
SHA-256: d5ea12b02aa8...

qwen-image-plus-sophnet is an Other skill for the OpenClaw ecosystem, created by duffycoder. ClawSecure audited this skill through our 3-Layer Audit Protocol covering all 10 OWASP ASI Top 10 categories. This skill received a security score of 95/100, qualifying for ClawSecure Verified status. The audit identified 2 findings across the scan's three security layers.

What does a score of 95 mean?

A security score of 95/100 places this skill in the Safe range. Skills scoring 80 or above qualify for ClawSecure Verified status, indicating they passed our comprehensive audit with minimal or no security concerns. ClawSecure calculates scores using a weighted deduction model: critical findings deduct 20 points, high-severity findings deduct 10, medium-severity 5, and low-severity 2. A perfect score of 100 means no findings were detected across all three audit layers.

3-Layer Audit Protocol

🔒 ClawSecure Proprietary Engine

Finding: Missing config.json - agent may not be properly configured
Severity: WARNING
Count: 1 finding

🔒 Advanced Static & Behavioral Analysis

Finding: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
Severity: WARNING
Count: 1 finding

📦 Supply Chain Security

Finding: No issues detected
Status: PASS
Count: 0 findings

Security Recommendations for qwen-image-plus-sophnet

  • Pin npm dependencies to exact versions
    Unpinned dependencies allow supply chain attacks where a compromised package version is automatically pulled into your skill. Use exact version numbers in package.json (e.g., 1.2.3 instead of ^1.2.3) to prevent unauthorized code from entering your dependency tree. ClawSecure's supply chain scanning checks every dependency against known CVE databases.

  • Add a config.json permissions manifest
    A config.json file declares what permissions your OpenClaw skill needs — file system access, network requests, shell execution, and more. Without it, users have no visibility into what your skill can do before installing. Adding a permissions manifest is the single most impactful security improvement for any OpenClaw skill.

OWASP ASI Framework Coverage

  • ASI01 Agent Goal Hijack
  • ASI02 Tool Misuse &
  • ASI03 Identity & Privilege
  • ASI04 Agentic Supply Chain
  • ASI05 Unexpected Code Execution
  • ASI06 Memory & Context
  • ASI07 Insecure Inter-Agent Communication
  • ASI08 Cascading Failures
  • ASI09 Human-Agent Trust Exploitation
  • ASI10 Rogue Agents

Categories highlighted were detected in this scan. ClawSecure provides comprehensive coverage across all 10 OWASP ASI Top 10 categories.

Context-Aware Analysis

This skill requests system-level capabilities which are standard for OpenClaw automation skills. ClawSecure's Context-Aware Intelligence analyzes capabilities in ecosystem context — differentiating real threats from normal agent functionality.

Findings are tagged with OWASP ASI (Agentic Security Initiative) Top 10 category references where applicable.