Client Manager
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill is an instruction-only local CRM that only requests filesystem read/write/exec access under a dedicated ~/.openclaw/client-manager/ directory and is internally consistent with that purpose.
This skill appears coherent and limited to a local-directory CRM. Before installing, consider: (1) All client data will be stored in plain JSON under ~/.openclaw/client-manager/ so protect that directory (disk encryption, file permissions, backups). (2) The skill declares use of exec/read/write tools — the SKILL.md says these are used only for directory and file initialization, but the platform-level exec permission can run arbitrary shell commands; trust depends on the platform enforcing the SKILL.md's constraints. (3) Review the full SKILL.md (it is large) to confirm there are no hidden steps that access other paths or networks. (4) If you need encrypted storage or automatic external backups, implement them outside the skill or verify the skill explicitly supports them. If any of the above concerns are unacceptable, don’t install or enable the skill until you can verify exact runtime behavior and platform enforcement.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
63/63 vendors flagged this skill as clean.