v1.0.1

Mova Churn Prediction

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:19 AM.

Analysis

The skill is coherent for churn analysis, but it relies on the MOVA plugin to process customer behavior and profile data and store audit records, so users should ensure those integrations are authorized.

GuidanceThis skill appears purpose-aligned and includes a human approval gate. Before installing or using it, confirm that the MOVA plugin is trusted, the customer-data connectors are authorized, real customer profiling is permitted under your privacy policies, and audit retention/access rules are acceptable.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

Requires the `openclaw-mova` plugin ... "installCmd":"openclaw plugins install openclaw-mova"

The skill depends on an external plugin that is not included in the artifact set. That dependency is disclosed and central to the MOVA workflow, but the plugin's provenance should be checked before installation.

User impactInstalling or using the skill may require adding a separate MOVA plugin that can perform the actual integration work.

RecommendationInstall the MOVA plugin only from the expected OpenClaw source and review its permissions separately.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

customer success manager reviews the list and chooses: launch campaign / launch selective / defer / escalate

The workflow can lead to customer-facing retention campaign decisions. The artifact requires a human gate, which makes this purpose-aligned rather than unsafe, but the action can still affect customers.

User impactA human-approved decision could initiate or route targeted retention actions for customers.

RecommendationConfirm the customer segment, threshold, campaign scope, budget, and approver before selecting any launch option.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusNote

SKILL.md

Customer activity data → events connector (read-only, no raw data stored by MOVA) ... Customer profiles → CRM connector (read-only)

The skill expects access to customer activity and CRM profile data. The access is described as read-only and directly related to churn prediction, but it is still sensitive business/customer data.

User impactThe workflow may access customer behavior, support, transaction, feature-usage, and profile information through connected systems.

RecommendationUse only authorized service accounts or workspace permissions and verify that the requested segment is appropriate for churn analysis.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityMediumConfidenceHighStatusNote

SKILL.md

Audit receipt — input features, model version, prediction scores, and human approval are all logged ... Audit journal → MOVA R2 storage, signed

The workflow persists customer feature data, churn scores, model version, and human decisions in an audit journal. This is disclosed and compliance-oriented, but it creates a durable record of sensitive profiling results.

User impactCustomer churn scores and decision history may be stored outside the immediate chat/session as a signed audit record.

RecommendationCheck MOVA audit retention, access controls, and privacy obligations before using the workflow on real customer data.

Insecure Inter-Agent Communication

SeverityMediumConfidenceHighStatusNote

SKILL.md

Segment ID + period + threshold → `api.mova-lab.eu` ... Customer activity data → events connector ... Feature vectors → churn model connector ... Customer profiles → CRM connector

The skill discloses multiple external service and connector data flows. They are purpose-aligned, but users should notice that customer data and derived scores cross system boundaries.

User impactCustomer-related data may be transmitted among MOVA, analytics, model, CRM, and audit systems.

RecommendationVerify data-processing agreements, regional requirements, and connector permissions before enabling the workflow.