VC投资筛选工具

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 1.4.1

Overview

This VC research skill is mostly purpose-aligned, but it needs Review because it automatically stores sensitive investment context and uses local credential/cache files without clear user controls.

Install only if you are comfortable with investment targets, preferences, query reasons, and reports being saved to Feishu and local OpenClaw memory/cache. Before using it for confidential diligence, confirm who can access the Feishu documents, how API keys are supplied, whether local caching can be disabled or cleared, and how stored preferences/reports can be deleted.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: Requiring a version-check script to run on every invocation introduces unnecessary local code execution unrelated to the user's analysis request. Even if benign, this expands the execution surface and may trigger unexpected shell/network activity each time the skill is used. The risk is elevated by the instruction that it must happen automatically and per-invocation.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code silently falls back to reading an API key from ~/.openclaw/workspace/memory/vc-api-keys.md, expanding credential access beyond explicit environment-based configuration. In an agent setting, reading workspace memory can expose secrets the user did not intend this specific skill to consume, creating unnecessary secret reach and possible cross-context credential use.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code silently falls back to reading an API credential from a user-local memory/config file under ~/.openclaw/workspace/memory/vc-api-keys.md. This broadens the credential trust boundary beyond the documented environment-variable flow, creating a risk of unintended secret ingestion from shared, stale, or attacker-influenced local state and making credential provenance unclear.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The script documentation says configuration occurs via environment variable, but the implementation also reads secrets from a local file without disclosing that behavior. This mismatch can lead operators to misjudge where credentials may be sourced from, weakening secret management controls and complicating audits or incident response.

Vague Triggers

High

• Confidence: 90% confidence
• Finding: The trigger phrases are extremely broad, including common requests like '评估一下', '调研一下', and 'XX怎么样', which can cause the skill to activate for ordinary conversation that was not intended to invoke a high-privilege workflow. Unintended activation is particularly risky here because the skill can use networked data sources and persist user data to memory/cloud archives. Broad triggering increases the chance of over-collection and unauthorized storage.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The activation condition 'when the user requests investment track screening, project evaluation, or industry analysis' lacks precise boundaries and leaves room for subjective over-triggering. Ambiguous activation is hazardous because this skill is designed to gather preferences, query external sources, and archive user-linked reports. In context, ambiguity directly increases privacy and overreach risk rather than being a harmless UX issue.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill mandates persistent archiving of analyses, user identity, preferences, and query reasons without any user-facing notice, consent, retention limit, or deletion policy. This is a real privacy and data governance issue because sensitive investment interests and user-linked context are stored by default in cloud documents and indexes. The business context makes it more dangerous: investment research can reveal confidential strategy, pipeline, or personal financial interests.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The local fallback writes reports and user-related data to the workspace filesystem when cloud permissions fail, but the skill does not warn users that sensitive content may be stored locally. Local filesystem persistence can expose data to other tools, users, backups, or later sessions without the user's awareness. In this skill, the reports include identifiers, preferences, and query reasons, so the local-storage fallback meaningfully increases exposure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document specifies automatic caching of all API results into a local SQLite database, but it does not define encryption, access controls, retention enforcement, or user/operator notice for potentially sensitive enterprise lookup history and returned data. In a SaaS/agent setting, this can create unintended persistent storage of commercially sensitive research queries, API-derived records, or regulated business information that could be exposed through filesystem access, backups, logs, or multi-tenant misconfiguration.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill reads a sensitive API key from a local file without any runtime notice, consent flow, or clear disclosure to the user. In agent workflows, undisclosed local secret access undermines user expectations and can cause accidental use of credentials from prior sessions or unrelated tools.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The wrapper sends user-provided company names, policy keywords, sentiment terms, and authentication headers to an external service, but the code provides no user-facing disclosure at the time of transmission. In an investment-screening context, those queries may contain sensitive targets, deal pipeline information, or confidential research topics, so silent outbound transfer raises privacy and confidentiality concerns.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The instructions explicitly persist user identity, preferences, and the reason for the query into long-lived memory files. This creates a durable data-retention channel for potentially sensitive profiling data without clear necessity, consent, or retention limits. In an investment context, such profiles can expose strategic interests and behavioral patterns over time.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The archival workflow requires every analysis to be saved with user identifiers, preferences, query reason, timestamps, and source information in Feishu or local files, then indexed for later retrieval. That is a substantial privacy and confidentiality risk because it systematizes collection and retrieval of user-linked investment intelligence. The mandatory nature and broad scope of stored metadata make this more dangerous than incidental logging.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The historical-query flow instructs the agent to retrieve prior reports from indexes, cloud docs, or local storage and return their contents on request. Without strong authorization checks and scoping, this can disclose previously stored, user-linked analysis to an unintended requester or later conversation context. Because the archived reports may contain identities, preferences, and strategic investment reasoning, the disclosure impact is significant.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.