Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Wikclawpedia API helper, with a disclosed submit feature that sends user-provided wiki intel to an external service.
Install only if you are comfortable with queries and submissions going to wikclawpedia.com. Do not submit secrets, personal data, internal URLs, proprietary notes, or anything you would not want reviewed or published.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Example:
curl "https://wikclawpedia.com/api/search?q=openclaw&limit=5"
The skill encourages submitting user-provided intel to an external service but does not clearly warn that submitted content, attribution, URLs, and other metadata will be transmitted off-platform and retained for review/publication. This creates a real privacy and data-handling risk because agents may forward sensitive workspace data, internal URLs, tokens accidentally embedded in payloads, or identifying information without informed consent.
The submit() function transmits caller-provided intel to an external domain with no built-in consent, disclosure, or guardrails around what data may be sent. In an agent-skill context, this can cause unreviewed exfiltration of user, workspace, or model-derived sensitive information if upstream code passes collected context into submit().
The manifest exposes a write-capable submit function that sends user-provided content to a public external API, but it gives no warning that submitted data leaves the local agent context and may be stored, reviewed, published, or attributed. This creates a real privacy and data-handling risk because an agent or user could inadvertently transmit sensitive prompts, personal data, internal notes, or proprietary information to a third party.
No suspicious patterns detected.