✓
Purpose & Capability
Name/description (detect sensitive data in OpenClaw logs) matches the implemented behavior: the script searches OpenClaw log files for API keys, passwords, IDs, phone numbers, etc. Required resources (none) are proportional to the stated purpose.
ℹ
Instruction Scope
SKILL.md only instructs running the included Python script. The script reads log files from a local OpenClaw log directory and persists detection results and user whitelist locally. Be aware the code stores a content_preview (up to ~100 chars) of matched lines in suspicious.json/whitelist files — these previews can include sensitive substrings.
✓
Install Mechanism
No install spec; this is an instruction+script package. No downloads or foreign package installation are present in the provided files.
ℹ
Credentials
The skill declares no required environment variables or credentials. It does read os.environ.get('LOCALAPPDATA') to build a default log path; otherwise it doesn't request secrets. The config contains an optional feishu_webhook field and README mentions Feishu notifications if configured — enabling that would send alerts to an external endpoint, so ensure any webhook is trusted and contains only metadata you accept sending.
ℹ
Persistence & Privilege
The script persists whitelist.json, suspicious.json, and report/alert files in the skill directory (normal). It is not always:true and does not modify other skills. Consider that persisted previews may include secret fragments and remain on disk until removed.
Scan Findings in Context
[embedded_api_key_in_repo_files] unexpected: alert_log.md (included in the package) contains an apparent API key string starting with 'sk-' in the visible excerpt. While the scanner pre-scan flags were empty, the repository itself holds examples/extracted secrets — this is not required for the tool's operation and may indicate leftover sensitive data in the package.
Assessment
This skill appears to do what it says: locally scan OpenClaw logs and keep a pending-review list and whitelist. Before installing or running it: 1) Inspect the full privacy_guard.py for any network calls (search for 'requests', 'urllib', 'socket', 'http', 'feishu', 'webhook') — the README and config mention an optional Feishu webhook; leave it blank unless you trust the endpoint. 2) Be aware that the tool stores a content_preview (up to ~100 chars) of matched lines in suspicious.json and alert_log.md — those previews can contain secrets; if you want strict non-persistence, modify the code to store only hashes or metadata. 3) Remove any embedded secrets found in the packaged files (alert_log.md contains an sk- key example) before sharing or deploying. 4) Run the script in a controlled environment first and review generated suspicious.json/alert_log.md to confirm the stored data is acceptable. If you want, share the remainder of privacy_guard.py (the truncated portions) and I can re-check specifically for outbound network calls or hidden behaviors.
