Og Board Individual
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: og-board-individual Version: 1.0.0 The skill bundle defines a task management skill. The `SKILL.md` file provides instructions and tool calls (`opengoat_task_list`, `opengoat_task_get`, etc.) that are entirely consistent with its stated purpose of viewing and updating tasks. Crucially, it explicitly instructs the AI agent: 'Do not run shell CLI commands like `sh ./opengoat ...`', which actively mitigates a common prompt injection vector. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or any other harmful intent.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent can update task statuses and add blockers, artifacts, or worklogs on the board.
The skill documents direct use of tools that can change task-board state. This matches the skill purpose, but users should notice that installation enables task updates.
opengoat_task_update_status({ ... "status": "todo|doing|blocked|pending|done" ... })Use this skill only when you want the agent to manage task-board records, and verify task IDs and status changes before relying on them.
If the wrong actor ID is used, task updates could be attributed to the wrong agent or affect the wrong assignment context.
The task updates are attributed through an actorId. This is expected for a task-board workflow, but the correct agent identity matters.
Replace `amazon-catalog-manager` with your agent id.
Confirm the agent ID and board permissions before allowing the skill to update tasks.