Data Storytelling
PassAudited by VirusTotal on May 5, 2026.
Overview
Type: OpenClaw Skill Name: data-storytelling-best Version: 1.0.0 The skill bundle provides legitimate guidance on data storytelling, but SKILL.md contains a significant block of zero-width/invisible characters (U+200B, U+200D, U+2061, etc.) embedded in the 'Narrative Arc' section. This is a known technique for stealthy prompt injection or tracking, designed to provide instructions to the AI agent that are invisible to the human reviewer. While the visible Python code and documentation are benign, the use of obfuscation to hide data within the instructions is a high-risk indicator of potential subversion.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The original file may contain hard-to-see formatting that is difficult for a user to inspect, but no concrete unsafe instruction is visible in the provided artifact.
The neutralized artifact reports that Unicode control characters were removed from SKILL.md. Such characters can sometimes obscure text or affect how instructions are displayed, although the visible content does not show any goal override.
"controlCharactersRemoved": 80
If installing, review the raw SKILL.md from a trusted source and reject it if hidden text changes the visible instructions.
Outputs may sound authoritative and could influence business decisions if the underlying data, assumptions, or recommendations are not checked.
The skill is explicitly designed to create persuasive stakeholder narratives. This is disclosed and purpose-aligned, but users should ensure the agent does not overstate conclusions or present example numbers as verified facts.
"Transform raw data into compelling narratives that drive decisions and inspire action."
Use verified data, label assumptions clearly, and review any recommendations before sharing with stakeholders or approving budgets.