Security audit

KPI for clawbot

Security checks across malware telemetry and agentic risk

Overview

This appears to be a KPI-tracking skill that keeps a local KPI memory file, with privacy considerations but no evidence of malicious behavior.

Install only if you are comfortable with KPI and retrospective information being retained locally in `~/.openclaw/workspace/memory/kpi.md`. Review that file periodically and avoid storing sensitive personal performance details unless you intend to keep them there.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to maintain and update a persistent local file (`~/.openclaw/workspace/memory/kpi.md`) but does not clearly warn the user that local data will be modified and retained across sessions. This can lead to unexpected persistence of business information, accidental overwrites, and privacy issues if users do not realize the skill writes to local memory.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The storage section mandates ongoing writes to a local memory file and says to 'always maintain' it, but omits a clear consent or warning mechanism for persistent modification of user data. In the context of KPI tracking, the stored content may include sensitive operational details, names, performance notes, and retrospective assessments, increasing the risk of unintended data retention and local data tampering.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.