Openclaw Agentpmt Tool Air Quality Pollen Information E89f3f

• Outcome: Review
• Latest audit: May 28, 2026, 1:45 AM
• Version:
  1.0.0

Overview

The skill’s air-quality purpose is plausible, but it also asks the agent to use wallet payments and follow private external job instructions without clear limits.

Review this before installing if you would let the agent act autonomously. Use only a dedicated low-balance wallet, require explicit approval before any credit purchase or payment signature, and do not allow the agent to follow private AgentPMT job instructions unless you can inspect and approve each job.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly states that generated maps are saved to cloud storage for 7 days, but the finding indicates this retention behavior is omitted from the user-facing warning/description context. That can cause unintentional disclosure of queried locations or environmental-interest data to a third-party service when users may reasonably expect a transient API response rather than persisted artifacts.

VirusTotal

No VirusTotal findings