Security audit
Security checks for vulnerabilities and agentic risk
This is a small business-advice skill with no executable code, network behavior, credential access, or hidden persistence.
Installers should understand this as a Portuguese-forward business coaching skill. Review the broad activation examples if ambiguous routing matters in your OpenClaw setup, but the inspected artifact does not show hidden execution, data access, or persistence.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Tasks Disponíveis
- create-offer - Create Grand Slam Offer
- generate-leads - Lead generation strategies
- set-pricing - Value-based pricing
- close-sale - Sales closing framework
The example invocation phrases are broad business-language requests that could unintentionally trigger this skill during ordinary conversation, causing ambiguous routing or execution without clear user opt-in. In a multi-agent environment, this increases the chance of the agent activating sales/growth workflows when the user only intended to ask a general question.
The file mixes Portuguese and English throughout the user-facing description and usage guidance, but it does not state whether the skill will respond in one language, preserve the user's language, or allow language selection. That can create an implicit language-policy issue if the skill defaults users into a language without opt-in.
The manifest description is written entirely in Portuguese, which can indicate a language-specific skill presentation without offering a user language choice. Under the policy rule, language constraints should either be optional for users or clearly documented as region-specific and justified.