Agent Efficiency Manager

• Outcome: Pass
• Latest audit: Jun 9, 2026 at 3:02 PM UTC
• Version:
  1.0.0

Overview

This skill coherently analyzes local OpenClaw agent configurations and can optionally publish recommendation summaries, with no evidence of hidden execution or malicious data handling.

Install only if you are comfortable with the skill reading your OpenClaw agent configuration. Keep reports local unless you intentionally provide a trusted webhook, because pushed reports may reveal agent names, installed skills, and optimization recommendations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill declares broad trigger phrases and also includes recurring automatic activation scenarios such as periodic analysis and push workflows. This can cause the skill to run without a narrowly scoped user request, increasing the chance of unintended access to agent configuration data and unsolicited downstream actions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill supports pushing recommendations and reports to external channels via webhook, but it does not provide a clear warning about data leaving the local environment or define what data may be transmitted. Because the skill analyzes agent configurations and recommendations, external push behavior could leak sensitive operational metadata, internal agent names, or configuration details to third-party services.

VirusTotal

64/64 vendors flagged this skill as clean.