Security audit
openclaw-deal-scout
Security checks across malware telemetry and agentic risk
Overview
The skill is a disclosed local Gmail-to-CRM automation that uses sensitive account access for its stated deal-triage purpose.
Before installing, review the cloned repository code, grant the narrowest Gmail and HubSpot permissions that work, keep the gateway bound to localhost unless you intentionally expose it, and confirm that outbound email sending requires the approval flow you expect.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
63/63 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.