SZZG007 Background Investigation

Comprehensive background investigation and profiling of customers, bloggers, and other individuals

This repository implements a local/simulated background-investigation tool that generates JSON reports and does not, as provided, access external APIs or ask for credentials. Before installing or enabling it in a production agent: 1) Review and confirm legal/ethical compliance for investigating real people in your jurisdiction. 2) Inspect the code yourself (or have someone you trust do so) before enabling any social-media API integrations — config.py contains placeholders you must populate to use real APIs. 3) If you enable real APIs, store API keys/secrets securely (not in plaintext files committed to the skill directory) and understand the blast radius of those credentials. 4) Be aware the tool writes reports to disk (output files may contain personal data); ensure appropriate access controls or anonymization. 5) If you want the agent to gather live data automatically, add explicit checks and consent/permission handling; otherwise the current behavior is simulated and safe for testing.

Type: OpenClaw Skill Name: szzg007-background-investigation Version: 1.0.0 The skill provides a framework for profiling and background investigations, which is an inherently high-risk capability. The main script `investigate.py` contains a vulnerability allowing arbitrary file writes or path traversal through unsanitized output paths (via the `--output` flag or the target name). While the current implementation is a simulation with placeholder API settings in `config.py`, the instructions in `SKILL.md` direct the AI agent to perform extensive data gathering and risk assessment on individuals without sufficient safeguards against misuse or unauthorized file system access.