Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only OpenClaw agent-building skill whose file and configuration guidance is coherent with its stated purpose.
Before installing, review any generated agent configuration that enables hooks, heartbeat checks, memory, or session cleanup, since those settings can affect what the agent runs, remembers, or deletes. The skill itself is documentation-only and does not automatically perform those actions.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/openclaw-workspaces/<agent-name>
cd ~/openclaw-workspaces/<agent-name>
openclaw setup --workspace .
In the session management section, the markdown instructs users to run openclaw sessions delete <sessionId> but does not warn that this removes stored conversation history. For markdown files, destructive operations that can affect user data should be accompanied by a warning about impact or irreversibility.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/.openclaw/workspace/memory
touch ~/.openclaw/workspace/memory/$(date +%Y-%m-%d).md
The document presents the skill guidance in Chinese and later shows 语言：中文 as the user language example, but it does not indicate that language is configurable or that the skill is intentionally limited to a Chinese-language audience. This can conflict with a language/locale policy requiring user choice or explicit justification for a fixed locale.
No suspicious patterns detected.