DevLog Agent Skill

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward developer journaling skill that installs a CLI and stores local project log entries, with no evidence of hidden data transfer or destructive behavior.

Install this only if you trust the dev-log-cli package source. Treat the journal as persistent project memory: do not log secrets, credentials, customer data, private security details, or sensitive internal reasoning, and periodically review or remove entries that should not be reused later.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The skill explicitly states that it stores project milestones, statuses, and context in a structured SQLite database, and later shows add/edit commands, but it does not clearly warn that these actions persist and modify local data. In an agent setting, that omission can lead to unintended writes, silent retention of sensitive work context, and accidental modification of prior entries.

Context Leakage

High

Category: Data Exfiltration
Content: A standardized journaling skill for OpenClaw agents to track progress, tasks, and project status using `dev-log-cli`. ## Description This skill enables agents to maintain a professional developer log. It's designed to capture context, project milestones, and task statuses in a structured SQLite database. ## Requirements - `dev-log-cli` (installed via `pipx`)
Confidence: 89% confidence
Finding: capture context

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal