Security audit
Security checks across malware telemetry and agentic risk
This skill is labeled as domain testing, but it actually reads a local OpenClaw username, queries an internal merchant CRM endpoint, and returns raw seller lookup results.
Review before installing. Treat this as an internal merchant lookup skill, not a simple domain-testing helper. Only install it if users are authorized to query the corporate merchant endpoint and are comfortable with the agent reading ~/.openclaw/username and sending that username with the merchant name. The publisher should rename and redescribe the skill, disclose the local identity requirement, add explicit user control, and avoid returning raw internal API responses.
65/65 vendors flagged this skill as clean.
No suspicious patterns detected.
