lck-analytics
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The utility library
scripts/_lib.jsexecutes thenpm root -gcommand usingexecFileSyncto locate the installation path of the required global package. - [EXTERNAL_DOWNLOADS]: The skill requires the external NPM package
lck-analyticsto be installed globally to function correctly. - [DYNAMIC_EXECUTION]: The skill uses dynamic
import()to load its core logic from computed filesystem paths during execution. - [DATA_EXPOSURE]: The skill manages a local cache directory (
.openclaw-lck-cache) and processes game data from files provided as command-line arguments. Access is limited to these data files and does not target sensitive system locations. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface through external CSV and JSON match data.
- Ingestion points:
scripts/sync-oracle.js(CSV) andscripts/analyze-live-game.js(JSON payloads). - Boundary markers: Absent.
- Capability inventory: File system writes (
writeJson), directory creation (mkdirSync), and environment discovery viaexecFileSync. - Sanitization: Not explicitly performed in the wrapper scripts; data integrity is handled by the primary
lck-analyticslibrary.
Audit Metadata