Openclaw Client Onboarding

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:26 PM UTC
• Version:
  1.0.0

Overview

This is an instruction-only onboarding skill that creates local customer files and quote drafts, with no executable code or hidden behavior found.

Before installing, confirm the listed contact details are appropriate for your business, review generated quotes before sending them, and treat the clients/ directory as customer data: store only necessary details, avoid secrets, restrict access, and delete records when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs creation of customer-specific files containing configuration, notes, and invoices, but it does not warn that customer data will be written to disk or require consent/minimization. This creates a real privacy and data-handling risk because personal or business-sensitive onboarding details may be stored locally in predictable paths without retention, access-control, or sanitization guidance.

VirusTotal

66/66 vendors flagged this skill as clean.