Cto Advisor

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: cto-advisor Version: 2.1.1 The 'cto-advisor' skill bundle is a well-structured set of tools and documentation designed for technical leadership guidance. The included Python scripts (tech_debt_analyzer.py and team_scaling_calculator.py) perform purely mathematical and logical calculations for engineering metrics without any risky system calls, network access, or file I/O. The SKILL.md instructions and reference documents are professional, align strictly with the stated purpose, and contain no evidence of malicious prompt injection or data exfiltration attempts.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Running the helper scripts executes local code and may create output files such as a JSON report.

Why it was flagged

The skill asks the user to run included Python helper scripts locally and generate a report file. This is disclosed and aligned with the skill's technical-debt assessment purpose, but users should notice that it involves local code execution.

Skill content
python scripts/tech_debt_analyzer.py --output report.json
Recommendation

Run the scripts only when you intend to use the calculators, and review the command and output path before executing.

What this means

Users have less external provenance information for the included helper code.

Why it was flagged

The registry metadata does not provide source or homepage provenance, while the skill includes runnable Python scripts. The scripts are disclosed in SKILL.md and no suspicious static findings are reported, so this is a provenance note rather than a concern.

Skill content
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill; Code file presence: 2 code file(s)
Recommendation

Review the included scripts before running them, especially if using them in a sensitive repository or business environment.