skills/bedesj/k-skill/lck-analytics/Gen Agent Trust Hub

lck-analytics

Pass

Audited by Gen Agent Trust Hub on Apr 13, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The utility library scripts/_lib.js executes the npm root -g command using execFileSync to locate the installation path of the required global package.
  • [EXTERNAL_DOWNLOADS]: The skill requires the external NPM package lck-analytics to be installed globally to function correctly.
  • [DYNAMIC_EXECUTION]: The skill uses dynamic import() to load its core logic from computed filesystem paths during execution.
  • [DATA_EXPOSURE]: The skill manages a local cache directory (.openclaw-lck-cache) and processes game data from files provided as command-line arguments. Access is limited to these data files and does not target sensitive system locations.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface through external CSV and JSON match data.
  • Ingestion points: scripts/sync-oracle.js (CSV) and scripts/analyze-live-game.js (JSON payloads).
  • Boundary markers: Absent.
  • Capability inventory: File system writes (writeJson), directory creation (mkdirSync), and environment discovery via execFileSync.
  • Sanitization: Not explicitly performed in the wrapper scripts; data integrity is handled by the primary lck-analytics library.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 13, 2026, 01:00 AM
Security Audit — agent-trust-hub — lck-analytics