PsyClaw GAD-7

• Outcome: Review
• Latest audit: May 29, 2026 at 9:29 PM UTC
• Version:
  0.1.0

Overview

This GAD-7 screening skill is coherent, but it tells the agent to send sensitive assessment answers and scores to a platform without clear consent or privacy handling.

Review before installing. Use it only if you trust the PsyClaw/OpenClaw health platform and are comfortable sending GAD-7 answers and scores there. Confirm the platform URL, API key scope, retention/deletion policy, and require explicit approval before any result upload or force-install of the companion skill.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to compute a sensitive mental-health style assessment locally and then return the complete JSON to a platform, but it provides no privacy notice, consent step, minimization guidance, or warning about transmitting potentially sensitive data. In a health-screening context, collecting and sending full answers, scores, timestamps, and identifiers can expose private behavioral or psychological state information and normalize unnecessary disclosure.

VirusTotal

65/65 vendors flagged this skill as clean.