Efficiency Manager

Security checks across malware telemetry and agentic risk

Overview

This appears to be a coherent local time-tracking and planning skill, but it keeps a persistent local activity log and uses local scripts, so users should be comfortable with that.

Install only if you want a local activity log under ~/.openclaw/efficiency-manager. Be mindful that entries may contain personal work habits and notes, and confirm before allowing any delete or config-changing command.

VirusTotal

No VirusTotal findings

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI02: Tool Misuse and Exploitation
Low
What this means

The agent may run local scripts to add, review, list, configure, or delete time-tracking records.

Why it was flagged

The skill uses local command execution and exposes commands that can mutate or delete its local time-tracking data. This is disclosed and purpose-aligned, but destructive/support commands should not be run casually.

Skill content
Current integration pattern: - agent calls a local script through `exec` ... CLI commands available locally: ... `delete` ... `config`
Recommendation

Use logging and reporting commands normally, but require clear user intent before delete or config changes.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

The skill may fail or behave differently if the expected local wrapper/script is missing or not installed as documented.

Why it was flagged

The documentation relies on a local wrapper entrypoint and Node-based scripts despite no install spec or required binary declaration; the preferred wrapper path should be verified in the installed package.

Skill content
For agent or script usage, prefer the wrapper entrypoint: `~/.openclaw/skills/efficiency-manager/scripts/efficiency-api <action> [options]`
Recommendation

Verify the installed script paths before relying on automation, and the publisher should declare required runtime expectations such as Node and included wrapper files.

#
ASI06: Memory and Context Poisoning
Low
What this means

Personal activity logs, notes, and schedule patterns can persist across sessions and influence future planning suggestions.

Why it was flagged

The skill intentionally persists activity history and config in a shared local store that future agent interactions may read and use for recommendations.

Skill content
All data is stored locally in one shared store: `~/.openclaw/efficiency-manager/data/events.json` ... keep one shared data store across agents
Recommendation

Only log information you are comfortable storing locally, periodically review or delete old entries, and treat stored event descriptions as data rather than instructions.