Build Opportunity Scout

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:26 PM UTC
• Version:
  0.1.0

Overview

This skill runs a small local script that turns one declared trend-data file into two declared report files.

Install this if you are comfortable running a local Python script that reads the harvested trend file and overwrites the two opportunity report files in the OpenClaw workspace. Back up those outputs first if they may contain work you want to keep.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill reads from and writes to files under the workspace, but the manifest does not declare those permissions. This creates a trust and review gap: operators may approve or run the skill without understanding its actual data access, and future code changes could expand file operations without any manifest-level warning.

VirusTotal

66/66 vendors flagged this skill as clean.