ClawHub
Back to skill

Security audit

DevLog Agent Skill

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward local developer journaling helper, with ordinary package-install and local data-retention risks users should understand.

Install only if you trust the dev-log-cli package source and are comfortable with setup installing Python tools in your user environment. Treat the journal as persistent project memory: avoid logging secrets, credentials, customer data, incident details, or sensitive internal reasoning, and periodically review or delete entries that should not be reused later.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script automatically installs pipx and modifies the user's PATH without any explicit confirmation, which changes the local execution environment and pulls software from external package sources. In a skill setup context, this is risky because users may not expect side effects during installation, and package installation via pip can introduce supply-chain exposure or persist environment changes silently.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script installs dev-log-cli via pipx automatically, without prompting the user or pinning/verifying the package source or version. This is dangerous because it executes an external package installation as part of setup, creating supply-chain risk and unexpected system changes if the package is compromised, renamed, or not the intended artifact.

Context Leakage

High
Category
Data Exfiltration
Content
A standardized journaling skill for OpenClaw agents to track progress, tasks, and project status using `dev-log-cli`.

## Description
This skill enables agents to maintain a professional developer log. It's designed to capture context, project milestones, and task statuses in a structured SQLite database.

## Requirements
- `dev-log-cli` (installed via `pipx`)
Confidence
93% confidence
Finding
The skill explicitly encourages agents to 'capture context' and log project milestones, blockers, and task statuses, which can cause sensitive internal context to be persisted in a SQLite database. In an agent setting, 'context' may include credentials, internal architecture, customer data, or security-relevant debugging details, creating a real risk of unintended data retention and later disclosure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.