Ufo

PassAudited by VirusTotal on May 9, 2026.

Overview

Type: OpenClaw Skill Name: ufo Version: 1.0.0 The 'ufo' skill bundle is a comprehensive research workbench designed for the structured analysis of declassified UAP/UFO documents. It includes a well-defined analytic methodology (evidence grading, claim taxonomy, and source triage) and functional Python scripts (inventory.py, extract_text.py, diff_releases.py) for processing local PDF and image files. The code uses standard libraries for PDF text extraction and file system operations without any indicators of malicious intent, data exfiltration, or unauthorized system access. The instructions in SKILL.md specifically emphasize skepticism guardrails and distinguishing document claims from verified facts.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the optional dependencies pulls code from the Python package ecosystem onto the user's machine.

Why it was flagged

The skill relies on third-party Python packages that are installed manually and are not pinned to specific versions. This is expected for PDF processing, but it is still a supply-chain consideration.

Skill content
python3 -m pip install pdfplumber pypdf
Recommendation

Install dependencies in a virtual environment, verify package names, and consider pinning trusted versions before use.

What this means

If the user points the skill at private or unrelated PDFs, their extracted text may be saved in the folder and used as analysis context.

Why it was flagged

The script persists extracted document text locally for later analysis. This is central to the skill's function, but users should remember that document contents may be sensitive or untrusted.

Skill content
Extract text from every PDF in <release_root>/release_*/ to <release_root>/text/.
Recommendation

Use the skill only on intended document folders, review generated text/artifacts before sharing them, and keep the built-in skepticism labels when interpreting claims.