Security checks across malware telemetry and agentic risk
This health-check skill is mostly aligned with diagnostics, but it overreaches by collecting sensitive local context and encouraging forced package installs and remote report delivery.
Review before installing. Use this only if you are comfortable with deep local OpenClaw inspection, including config, logs, system details, and workspace identity files entering the agent context. Avoid accepting `--force` package-install recommendations without independently checking the packages, and disable or avoid remote report channels unless you explicitly want diagnostic data sent to those destinations.
]
});
const safe = redactSecrets(payload);
execSync("curl -sS -X POST -H \"Content-Type: application/json\" -d " + JSON.stringify(safe) + " " + JSON.stringify(webhook), { timeout: 10000 });
results.push({ channel: "slack", status: "delivered" });
break;
}}
});
const safe = redactSecrets(payload);
execSync("curl -sS -X POST -H \"Content-Type: application/json\" -d " + JSON.stringify(safe) + " " + JSON.stringify(webhook), { timeout: 10000 });
results.push({ channel: "dingtalk", status: "delivered" });
break;
}}]
});
const safe = redactSecrets(payload);
execSync("curl -sS -X POST -H \"Content-Type: application/json\" -d " + JSON.stringify(safe) + " " + JSON.stringify(webhook), { timeout: 10000 });
results.push({ channel: "discord", status: "delivered" });
break;
}try {
const tracked = execSync("git ls-files " + HOME + " 2>/dev/null", { encoding: "utf8", timeout: 3000 });
const secretFiles = tracked.split("\n").filter(f =>
f.endsWith(".key") || f.endsWith(".pem") || f.endsWith(".env") ||
f.includes("credentials") || f.includes("secret")
);
for (const sf of secretFiles) {64/64 vendors flagged this skill as clean.