利润优化引擎

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:44 PM UTC
• Version:
  1.0.0

Overview

This is a simple local order and profit tracker that saves order files on the user's machine, with no evidence of hidden network, credential, or destructive behavior.

Install only if you are comfortable with order, pricing, cost, and payment-status records being saved locally in the OpenClaw workspace state directory. Treat the payment confirmation feature as manual bookkeeping, not real payment verification.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises executable commands that invoke local Python scripts capable of order management and report generation, which implies file read/write behavior, yet the manifest declares no permissions or capability boundaries. This creates a transparency and governance gap: users or platforms may authorize and run the skill without understanding that it can access or modify local data.

VirusTotal

65/65 vendors flagged this skill as clean.