Security audit
Security checks for vulnerabilities and agentic risk
This skill appears benign: it looks up supermarket prices by downloading and caching a public CSV, with the cache behavior disclosed and limited to its own data folder.
Before installing, users should be comfortable with the skill contacting the Consumer Council pricewatch site and storing a short-lived CSV cache inside the skill directory. The packaging inconsistency in openclaw.plugin.json may need correction for compatibility, but I did not find evidence of hidden access, exfiltration, destructive behavior, or unsafe persistence.
The manifest states that the skill auto-detects the query language and responds in that language. This imposes a language/locale behavior without offering the user a choice or opt-in, which matches the policy category for language or locale constraints.
This code fetches a CSV from the network, deletes prior cached CSV files, and writes a new file to disk. Although it logs these actions to stderr, there is no user-facing disclosure in the normal output or prompt that the skill performs network access and local file modification, which falls under missing user warnings for code files.
