Family Partner is an AI-driven family intelligent assistant, committed to becoming an indispensable digital partner for every family.We not only help families manage trivial affairs, but also understand family dynamics, promote member connections, and witness family growth.

Security checks across malware telemetry and agentic risk

Overview

This appears to be a coherent local family-organizer skill, but it intentionally keeps sensitive household information in a persistent SQLite database and can modify that database through agent-generated commands.

Before installing, be comfortable with a local database at ~/.openclaw/family-partner/family.db containing family schedules, allergies, birthdays, chores, and other private details. Keep backups, restrict local file access, do not assume the database is encrypted by default, and confirm any delete or bulk-edit requests.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI06: Memory and Context Poisoning
Medium
What this means

Private household, health, school, work, and child-related details can persist locally and be reused in future responses.

Why it was flagged

The skill intentionally stores sensitive family details for later lookup and reminders.

Skill content
Family Memory (💭) ... Record and query family member preferences, allergies, and important information. ... Record important information (medical, school, work)
Recommendation

Only store information you are comfortable retaining, protect the database with OS permissions or encryption if needed, and periodically delete or back up records intentionally.

#
ASI02: Tool Misuse and Exploitation
Low
What this means

A misunderstood request or unsafe generated SQL could change or remove family records in the local database.

Why it was flagged

The skill uses direct SQLite shell commands to create, update, and delete local family records.

Skill content
Create new events with participants and location
- Delete or modify existing events
...
sqlite3 ~/.openclaw/family-partner/family.db
Recommendation

Ask the agent to confirm before delete/update operations, keep backups of family.db, and review generated SQL for unusual destructive actions.

#
ASI10: Rogue Agents
Low
What this means

If scheduled reminders are enabled, private family schedules or tasks may be surfaced automatically at configured times or channels.

Why it was flagged

The documented morning briefing can operate on a schedule rather than only in response to an immediate user prompt.

Skill content
Family Morning ... Scheduled trigger (e.g., 8 AM daily)
Recommendation

Enable scheduled briefings only where desired, verify recipients and channels, and disable or limit automatic reminders in shared environments.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

If a different package build includes additional scripts or directories, those contents may not be represented by the reviewed artifacts.

Why it was flagged

The package metadata references directories that are not present in the provided file manifest, although no install spec or automatic execution of those paths is shown.

Skill content
"files": [
    "family-partner/",
    "SKILL.md",
    "init.sql",
    "README.md",
    "README_CN.md",
    "LICENSE.txt",
    "scripts/"
  ]
Recommendation

Install from a trusted registry source and review the actual installed package contents, especially any scripts/ directory, before relying on it.