Data Enricher

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The skill bundle is classified as benign. The `SKILL.md` file provides instructions for an AI agent to enrich lead data, which involves web browsing, making API calls to Hunter.io using a provided API key, and saving processed data to a local file (`workspace/leads-enriched-YYYY-MM-DD.json`). All described actions are directly aligned with the stated purpose of 'Data Enricher' and do not show any evidence of intentional malicious behavior such as data exfiltration, unauthorized execution, persistence mechanisms, or prompt injection attempts to subvert the agent's intended function.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent may use a third-party API key to look up email addresses for lead domains.

Why it was flagged

The skill expects use of a Hunter.io API key for domain-search calls. This is purpose-aligned, but users should provide a scoped key and note that the registry metadata declares no required credentials.

Skill content

api_key={HUNTER_API_KEY}

Recommendation

Use a dedicated Hunter.io key with limited scope or quota, and avoid sharing keys across unrelated workflows.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent could add lead records to a Notion workspace or database if connected to one.

Why it was flagged

The skill implies reading from and writing to a Notion lead database. This matches the purpose, but it is still a writable business-data integration that should be scoped by the user.

Skill content

Before adding any lead: ... Check if domain_key exists in Notion ... Format all data before Notion sync

Recommendation

Confirm the intended Notion database, review batches before sync, and use permissions limited to the relevant lead pipeline.

Note

ASI06: Memory and Context Poisoning

What this means

Enriched email/contact data may remain in the workspace after the task is complete.

Why it was flagged

The skill persists enriched lead data, including contact emails, to a workspace file. This is expected for batching but creates a retained copy of contact data.

Skill content

Save formatted batch to workspace/leads-enriched-YYYY-MM-DD.json

Recommendation

Store the workspace file in an appropriate location, restrict access, and delete old batches when no longer needed.