ClawHub
Back to skill

Security audit

Ai Freelance Helper

Security checks across malware telemetry and agentic risk

Overview

This freelance helper is purpose-aligned and uses disclosed local workspace files, with no evidence of hidden network access, credential theft, destructive behavior, or privileged persistence.

Install only if you are comfortable keeping freelance project, client, pricing, and contract details in local OpenClaw workspace files. Avoid storing unnecessary personal or confidential client information, protect backups and synced folders, and only ask it to inspect websites you are comfortable contacting.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly states that client, project, and contract data are stored locally, but it does not warn users that these files may contain sensitive personal and business information such as client identities, budgets, communications, and contractual terms. This creates a real privacy and data-handling risk because users may unknowingly persist sensitive information in predictable filesystem locations without guidance on access control, retention, or protection.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The skill advertises fetching user-supplied web pages to identify outsourcing opportunities, but it does not disclose that visiting a URL may transmit the URL and related metadata to external services or tools. While the example is not inherently malicious, the lack of transparency can expose user interests, targets, or tracking data and may surprise users who assume analysis is purely local.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.