KPI Tracker
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: afrexai-kpi-tracker Version: 1.0.0 The OpenClaw AgentSkills bundle for the KPI Tracker skill appears benign. All files, including `_meta.json`, `SKILL.md`, and `README.md`, describe a legitimate business intelligence tool. The instructions for the AI agent in `SKILL.md` are clear, aligned with the stated purpose (reading/writing `kpi-config.json` and `kpi-data.json`), and do not contain any prompt injection attempts, instructions for data exfiltration, malicious execution, or persistence mechanisms. External links provided are for user information and marketing, not for agent interaction leading to execution or data theft.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may create or update KPI data and report files in the workspace.
The skill gives the agent authority to modify a local data file. This is expected for a KPI tracker and is scoped to the workspace/custom KPI files, but users should notice that installation enables file changes when invoked.
Read/write `kpi-data.json` for historical values
Use the skill in the intended project workspace, review important KPI entries before relying on reports, and keep backups if the data is business-critical.
Stored KPI history can influence later reports and may reveal business performance information to anyone with access to the workspace files.
The skill persists KPI history and later reuses it for trend analysis. This is core to the skill, but the stored business metrics may be sensitive and inaccurate entries could affect future reports.
Store historical data in a simple JSON file for trend analysis
Store KPI files only in appropriate workspaces, avoid putting confidential metrics in shared locations unless intended, and verify the historical data before using it for decisions.