ClawHub
Back to skill

Security audit

Bankroll Manager — Cross-Platform P&L Tracker

Security checks across malware telemetry and agentic risk

Overview

This skill is a small local betting bankroll tracker that writes user-requested bet records to a disclosed SQLite database, with no evidence of hidden code, network access, or credential use.

Install this only if you want a local betting or prediction-market ledger. Review any sqlite3 write before it runs, especially free-text notes with quotes or unusual characters, and remember that the resulting bankroll data remains on disk at ~/.openclaw/data/bankroll.db.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to perform a direct `sqlite3` INSERT into a persistent database file under `~/.openclaw/data/bankroll.db` without any warning, confirmation step, input validation guidance, or rollback/audit safeguards. In an agent setting, this can cause unintended or user-unapproved modification of financial tracking data, and the danger is increased because the skill’s purpose is to manage bankroll and risk limits, making integrity of the stored data important.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal