Equipment Maintenance Log

• Outcome: Pass
• Latest audit: May 29, 2026, 8:34 PM
• Version:
  1.0.0

Overview

This is a local equipment maintenance tracker that stores its log on the user's machine and does not show hidden network, credential, or unrelated behavior.

Before installing, be aware that equipment names, calibration dates, intervals, and locations are stored locally in ~/.openclaw/equipment_log.json. Use it only if that local record is acceptable for your lab or organization, and delete or protect that file if the equipment/location metadata is sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill documentation exposes write-like capability via a local persistence path (`~/.openclaw/equipment_log.json`) without declaring corresponding permissions. Undeclared file-write behavior weakens transparency and trust boundaries, because a user or platform may approve the skill under the assumption it is read-only or low-impact when it can actually modify local state.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 79% confidence
• Finding: The declared description omits material behaviors including persistent local storage, listing stored equipment details, and generating JSON reports. This mismatch can mislead reviewers about data handling and system impact, which is risky because equipment names and locations may be sensitive operational metadata and persistence changes the security/privacy profile of the skill.

VirusTotal

66/66 vendors flagged this skill as clean.