Security audit
openclaw-deal-scout
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed local Gmail-to-CRM automation that uses sensitive account access for its stated deal-triage purpose.
Before installing, review the cloned repository code, grant the narrowest Gmail and HubSpot permissions that work, keep the gateway bound to localhost unless you intentionally expose it, and confirm that outbound email sending requires the approval flow you expect.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.