Client Data Management

• Risk level: Low
• Analyzed: Feb 21, 2026, 5:45 PM
• Findings: 0
• Version: 0.1.0

Overview

The skill is internally coherent for a file-based client database: it only requires OPENCLAW_DATA_DIR plus the openclaw and jq binaries and uses local filesystem paths — but it omits important operational details (encryption key management, role checks, and who enforces GDPR/audit controls) that you should verify before trusting it with real client data.

This skill appears coherent for a local, file-based client database, but before installing or trusting it with real client data confirm the following: (1) openclaw binary behavior — who performs encryption/decryption, where are encryption keys stored, and who controls key access? (2) Authorization and audit enforcement — ensure the platform/openclaw enforces role checks before decrypting or exporting data (SKILL.md assumes role checks but gives no mechanism). (3) File permissions and data-dir isolation — set strict filesystem permissions on OPENCLAW_DATA_DIR and consider isolating it from other skills or network access. (4) GDPR export safeguards — verify retention/undeletable records required by law are handled correctly and that exports are delivered securely. (5) Review openclaw source or documentation (or ask the skill author) to confirm encryption, key management, and audit log implementation; do not assume these protections are present merely because the README claims them. Finally, be cautious if you plan to run the suggested sudo apt install command on production systems — prefer reviewing binaries and installing via your standard package management policies.