ClawHub
Back to skill

Security audit

OpenRouter Rankings Tracker

Security checks across malware telemetry and agentic risk

Overview

This skill appears to perform disclosed ranking-data workflows, with optional local saving and Feishu export that users should understand before enabling.

Before installing, confirm you are comfortable with --save leaving ranking data under ~/.openclaw/data and only use --push when you intend to send that data to Feishu. Review any Feishu credentials or destination settings and delete saved files if you do not want local retention.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Low
Confidence
89% confidence
Finding
The skill documents saving fetched data to a persistent path under ~/.openclaw/data without warning the user that data will be retained locally. Even if the content is rankings data rather than obviously sensitive user data, silent persistence can surprise users, create retention/privacy issues, and leave artifacts on shared systems or managed environments.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill advertises a --push option and automated workflow to push data to Feishu, but does not clearly warn that data will be transmitted to an external third-party service. External transmission is materially more sensitive than local storage because it can disclose data, metadata, schedule activity, and possibly credentials or workspace context if users enable automation without understanding the destination.

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.