UniFi Advisor

• Outcome: Pass
• Latest audit: May 31, 2026 at 3:58 PM UTC
• Version:
  1.0.2

Overview

This UniFi advisor is a read-only network inspection skill with disclosed API-key use and a local site cache; the cache is a privacy consideration but not evidence of unsafe behavior.

Install only if you are comfortable granting a UniFi API key that can read network inventory through api.ui.com. Prefer the least-privilege key available, avoid shared machines for sensitive environments, and delete ~/.openclaw/unifi-skill.json if you do not want cached site metadata left locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill caches site metadata derived from the user's UniFi environment into a local file under the home directory without surfacing that behavior in the high-level description. Even if the cache does not contain the API key, host names, site mappings, hardware details, connection state, and related identifiers can be sensitive in shared, multi-user, or managed environments and may persist longer than a user expects.

VirusTotal

66/66 vendors flagged this skill as clean.