Skillv1.0.7

ClawScan security

Sensitive Data Masker · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousMar 3, 2026, 3:53 PM

Verdict: suspicious
Confidence: high
Model: gpt-5-mini
Summary: The skill's purpose and code mostly align, but there are important inconsistencies and an implementation detail that risks exposing sensitive data (passing secrets as command-line arguments) and a missing declared dependency (cryptography) that the code requires.
Guidance: This skill mostly does what it says (local PII detection + local mapping/restore), but two issues need your attention before installing: 1) The Python code requires the cryptography library (it will exit if missing) yet the SKILL.md and metadata do not include installing cryptography — make sure to pip install cryptography so the skill's encryption works as intended. 2) The hook implementation passes full message text as a command-line argument to the masker process; command-line arguments are visible to other users on the same machine (ps aux), which can leak secrets. Prefer changing the handler to pass sensitive content via stdin or another IPC mechanism, or ensure the host is multi-user-safe and that only trusted accounts exist. Also review file permissions and backup policies for ~/.openclaw/data/sensitive-masker (the mapping DB and the encryption key are stored locally and must be protected). If you cannot guarantee host-level protections or cannot enforce the code change to avoid argv exposure, treat this skill as risky and do not enable it on multi-tenant systems.

Review Dimensions

Purpose & Capability: noteThe name/description match the included code: it uses Presidio for detection and SQLite + encryption for local mapping and restoration. However, the runtime requirements declared in metadata/SKILL.md do not include the cryptography package even though the Python code requires it and fails if it's not present. That omission is incoherent with the code's stated 'REQUIRED - no fallback' encryption behavior.
Instruction Scope: concernThe handler launches the Python masker by putting the entire message content on the child process command line (spawn('python3', [MASKER_SCRIPT, 'mask', content])). Passing raw messages (potentially secrets) as argv exposes them to other local users via process listings (ps), which contradicts the skill's goal of protecting secrets. Aside from that, the instructions and code operate only on local storage and do not call external endpoints.
Install Mechanism: noteThere is no automatic install spec; SKILL.md lists pip/spacy install commands for the user to run. That is low-risk. However, the code requires the cryptography module (and enforces encryption) but the declared install recommendations and metadata do not include it — an inconsistency that will cause the skill to fail or force manual installation.
Credentials: noteThe skill requests no environment variables or external credentials (appropriate). It writes files under ~/.openclaw/data/sensitive-masker and generates an encryption key file; these are proportionate to local mapping/restoration. Note: storing both an encrypted DB and the encryption key locally means a compromise of the user account or backups will expose cleartext; the README warns about backups, but this is an expected tradeoff and should be considered by operators.
Persistence & Privilege: okalways:false and the skill registers a message:received hook (expected for this purpose). It writes its own files under the user's OpenClaw data directory and does not modify other skills or system-wide settings. No excessive platform privileges are requested.