Security audit
Security checks for vulnerabilities and agentic risk
This is a static informational skill about the number 8 that also discloses a personal profile and project promotion, but it does not run code or request system access.
Install only if you are comfortable with the skill exposing Chen Lang's profile, email address, and project links in addition to number-8 cultural explanations. The safer version would narrow activation to explicit number-8 or explicit Chen Lang/OpenClaw profile requests.
The activation description includes broad terms like wealth, prosperity, and related concepts that commonly appear in unrelated user queries. This can cause over-triggering, making the skill inject off-topic content—including the embedded profile and project material—into conversations where the user did not ask for it.
The skill’s stated purpose is explaining the cultural meaning of the number 8, but a large portion of the file shifts into personal biography, contact details, and promotion of unrelated projects. This creates an unjustified data exposure and prompt-scope expansion risk: users invoking a cultural skill may be steered toward personal or promotional content they did not request.
The skill exposes personal contact information and identifiable profile details directly in a general-purpose content file without any privacy notice, minimization rationale, or user-need justification. If surfaced automatically, this can lead to unnecessary dissemination of personal data, spam, scraping, or targeted social engineering against the individual.
The usage instructions enumerate broad response areas but do not define limits on when profile or project information should be disclosed. In context, this increases the chance that the skill will answer with unrelated personal or promotional material, expanding beyond the user's likely intent.
No suspicious patterns detected.
