Nex Gdpr

GDPR and AVG (Belgian data protection law) compliance handler for agency operators, data controllers, and organizations managing data subject requests. Regis...

This skill mostly does what it claims (search local session files, logs, and some sqlite DBs, compile exports, and optionally delete files). Before installing: - Inspect setup.sh before running (it is present but no install spec was published). It may create a venv, place an executable, or download dependencies. - Confirm how NEX_GDPR_SCAN_PATHS is supposed to be used; the metadata lists it but the shipped code does not appear to read it — ask the author or review config changes if you need custom scan paths. - Back up important data and test on a non-production account first. 'Erasure' operations can remove files owned by the agent user; the code deletes user-owned files after scanning (it attempts to avoid system paths), so verify results before using on real requests. - Verify file permissions on ~/.nex-gdpr and where export ZIPs are stored; ensure exports are encrypted before sending to requestors (README recommends this but does not enforce it). - Review setup.sh and any network calls it may perform. If you cannot inspect setup.sh, do not run it in production. - If you expect the skill to honor an env var for custom scan paths (NEX_GDPR_SCAN_PATHS), require the author to implement it or edit lib/config.py to add support. Given these mismatches and the destructive nature of erasure functions, proceed only after code inspection and testing.

Type: OpenClaw Skill Name: nex-gdpr Version: 1.0.0 The nex-gdpr skill bundle provides a suite for managing GDPR compliance, but it possesses high-risk capabilities that warrant a suspicious classification. The tool is designed to recursively scan the user's home directory, OpenClaw sessions, and specific third-party application databases (e.g., life-logger, inbox, and notes) for personal data (lib/scanner.py, lib/config.py). It also includes functionality to securely delete files and package discovered data into ZIP archives for export (lib/processor.py). While these features are aligned with the stated purpose of handling GDPR 'Right to Access' and 'Right to Erasure' requests, the broad read/write access to sensitive files and other application databases creates a significant risk if the agent is manipulated via prompt injection. No evidence of intentional data exfiltration was found, though it references the domain nex-ai.be.