Insight Tracker

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: insight-tracker Version: 1.0.1 The insight-tracker skill is a well-structured tool for managing observations and patterns. The shell scripts (add-insight.sh and list-insights.sh) implement safe data handling practices to prevent shell injection, and the test.sh file explicitly includes a security test case to ensure user-provided content is not executed. No evidence of data exfiltration, malicious instructions, or suspicious network activity was found.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Insights, preferences, or transcript excerpts saved by the skill may be reused in later sessions and should not be treated as verified instructions or used to store secrets.

Why it was flagged

The skill is designed to preserve conversation-derived and memory-derived material for later search and reuse, which is expected for this purpose but creates persistent context that can contain sensitive or untrusted content.

Skill content

Accepts insights in various formats:
- Direct text input
- Session transcript excerpts
- Memory file references
- Research findings

Recommendation

Store only information the user wants retained, keep the data directory scoped, and review retrieved insights before relying on them.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the helper scripts are used, they will execute local shell commands to create, list, or test insight files.

Why it was flagged

The registry metadata says there is no install spec while the artifact includes bash helper scripts. Their reviewed contents are local and purpose-aligned, but users should know the skill is not purely prose if they choose to run the helpers.

Skill content

No install spec — this is an instruction-only skill.

Code file presence
3 code file(s): scripts/add-insight.sh ... scripts/list-insights.sh ... scripts/test.sh

Recommendation

Run the bundled scripts only from the reviewed skill directory and avoid setting INSIGHT_DATA_DIR to sensitive locations unless that is intentional.