Ride Insights
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's files, instructions, and requested environment variables match its stated purpose (fetch Gmail receipts locally, send them to a local OpenClaw Gateway for extraction, store results locally), and there are no obvious mismatches or hidden exfiltration paths.
This skill appears internally consistent, but it processes highly sensitive data (full receipt HTML and message metadata). Before installing or running it: (1) ensure you run a trusted local OpenClaw Gateway and set OPENCLAW_GATEWAY_URL to localhost/127.0.0.1/::1 only (the code refuses non-local hosts), (2) verify where your gateway token is stored — either in env OPENCLAW_GATEWAY_TOKEN or in ~/.openclaw/openclaw.json — and be comfortable with that file containing a token, (3) ensure your gog CLI is properly authenticated for the Gmail account you intend to use and review gog permissions, (4) confirm the skill with the user before extraction (SKILL.md requires explicit consent), (5) treat data/ride-insights/emails.json as sensitive and delete it when no longer needed, and (6) if you do not want the agent to autonomously access Gmail, disable or gate autonomous invocation at the agent level. Overall the skill's actions align with its description — the main risk is handling of sensitive emails, not covert exfiltration or unrelated credential access.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.