Org Learning Ops Skill

• Outcome: Pass
• Latest audit: May 28, 2026 at 12:12 PM UTC
• Version:
  1.0.1

Overview

This skill is a governance helper that asks to read OpenClaw session and configuration data, which is sensitive but consistent with its stated purpose and disclosed behavior.

Install only if you are comfortable letting the skill review OpenClaw session logs and agent configurations. Use it in admin or governance contexts, avoid running it over unrelated private agents unless intended, and review any proposed installs, updates, activations, or configuration changes before approving them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs access to full conversation history across agents and visible agent configuration, which can expose sensitive prompts, personal data, secrets, and internal operational metadata far beyond a minimally necessary scope. The danger is increased because the collection is framed as a fixed input and mandatory analysis step, with no user-facing notice, consent gate, minimization rule, or redaction requirement.

VirusTotal

64/64 vendors flagged this skill as clean.