private computation
WarnAudited by ClawScan on May 10, 2026.
Overview
The skill is a privacy-framework document, but it encourages use with sensitive credentials while making strong zero-knowledge and compliance claims that are not substantiated by the provided artifacts.
Treat this as a review-required privacy/security framework rather than a verified zero-knowledge system. Before installing, inspect the npm package source, pin the version, verify the claimed protections, and avoid using real medical, financial, or production credentials until the implementation has been independently reviewed.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user could over-trust the framework for medical, financial, or regulated data before the advertised protections actually exist or are verifiable from the artifacts.
The artifact markets strong privacy/compliance capabilities for sensitive tasks, but the architecture labels major zero-knowledge and TEE pieces as future work.
**Zero-Knowledge Execution for Sensitive Agent Tasks** ... **GDPR & HIPAA Compliant** ... Crypto Layer (Future) ... zk-SNARKs ... TEE
Do not rely on the zero-knowledge, TEE, HIPAA, GDPR, or compliance claims without independently reviewing the actual package implementation, documentation, and audits.
Users would be trusting an external package to implement the privacy and secret-handling behavior.
The provided skill has no code files or install spec, so real functionality depends on an external npm package that was not included in the scanned artifacts.
npm install openclaw-private-computation
Review and pin the npm package version before installing, and inspect the package source and lockfile before giving it secrets.
If used, the framework may hold credentials that allow access to sensitive third-party accounts and services.
The documented API stores and retrieves API keys, including examples for LLM, medical, and bank credentials.
await agent.setSecret('OPENAI_API_KEY', 'sk-...'); ... const bankKey = await agent.getSecret('BANK_API_KEY');Use least-privilege keys, avoid production or regulated credentials until reviewed, and revoke keys if you stop using the package.
Secrets and audit metadata may remain on disk and may be reused across tasks depending on how the package is configured.
The framework documents persistent local storage for encrypted secrets and audit-related state.
storagePath: string, // Default: ~/.openclaw ... masterKey: string // Auto-generated if not provided
Choose a controlled storage path, understand master-key handling and audit retention, and delete stored secrets when no longer needed.