v1.5.2

Mbti Guru

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:25 AM.

Analysis

The skill appears aligned with its MBTI testing purpose, with the main things to notice being local storage of personality-test progress/history and optional channel credentials.

GuidanceThis looks safe to use for its stated MBTI testing purpose. Before installing, be aware that it saves progress and recent results locally, protect any optional bot token you configure, and do not treat the personality report as clinical or authoritative career advice.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Human-Agent Trust Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

Professional / 专业版 | 200题 | ~35分钟 | 临床级

The professional version is described as clinical-grade, which could cause users to over-trust personality or career recommendations.

User impactUsers may give the report more authority than a personality quiz should have.

RecommendationTreat results as reflective guidance, not as clinical, diagnostic, hiring, or career-determining advice.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityInfoConfidenceHighStatusNote

CLAWHUB.md

telegram:\n    required: false\n    config: openclaw_telegram_botToken

The artifact documents an optional Telegram bot token for channel integration; this is expected for a bot skill, but it is still a credential users should protect.

User impactIf you enable Telegram integration, the configured bot token grants the skill access to operate as that bot.

RecommendationUse a dedicated bot token with only the access needed for this skill, and rotate or revoke it if the skill is removed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

lib/mbti_core.py

save_session(chat_id=chat_id, version=state.version, current_index=state.current_index, answers=state.answers, questions_total=len(state.questions))

The skill persists in-progress answers and chat identifiers so tests can be resumed; this is purpose-aligned but involves personal assessment data.

User impactYour MBTI answers and progress may remain on the local server until completed or deleted.

RecommendationInstall only if you are comfortable with local storage of test progress/history, and delete the skill's data directory if you want to clear saved results.