Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Feishu cron-status notifier, but it uses hard-coded private OpenClaw paths and Feishu credentials to send local run details externally, so users should review it before installing.
Install only if you intend to monitor that specific OpenClaw cron job or are prepared to edit the hard-coded job ID, run-log path, config path, recipient, and message labels. Treat the Feishu app secret and run error/summary fields as sensitive, and check that messages will go to the intended recipient before running it.
Referenced artifact was not completely inspected
- `scripts/monitor-tracker-runs.js`: Read the target cron job's most recent `finished` run record and send a compact Feishu DM.
Referenced artifact was not completely inspected
- `scripts/monitor-tracker-runs.js`: Read the target cron job's most recent `finished` run record and send a compact Feishu DM.
Referenced artifact was not completely inspected
- `scripts/monitor-tracker-runs.js`: Read the target cron job's most recent `finished` run record and send a compact Feishu DM.
The skill advertises behavior that reads local run data and sends a Feishu private message, which implies network-capable actions, but it declares no explicit tool scope or permissions. This weakens security boundaries because an agent may invoke network operations without clear user-visible authorization constraints, increasing the chance of unintended data egress.
The invocation description is broad enough to match generic monitoring and notification requests, which can cause the skill to be selected in contexts where the user did not specifically intend Feishu messaging or latest-run disclosure. Over-broad matching is dangerous because it can trigger notification-sending behavior in ambiguous situations and expand the skill's effective reach beyond its narrow purpose.
The skill description says it sends a private Feishu message with execution time, status, and detail, but it does not warn users that operational run details are being transmitted to an external messaging platform. This creates a data-leakage risk because job metadata or failure details may contain sensitive internal information and users are not prompted to confirm that disclosure.
This is a markdown file, so SQP-2 applies to missing warnings in the skill description. Line L08 states that the script uses feishu.appId and feishu.appSecret to send a private Feishu message, but the document provides no warning about external transmission or handling of sensitive configuration values.
The skill is described as a configurable generic monitor, but the implementation is hard-coded to a specific local config path, job ID, job name, and run-log file. This creates a supply-chain/deceptive-behavior risk because users may deploy it believing it monitors arbitrary jobs, while it instead reads and notifies on one fixed tracker, potentially exposing private operational metadata from the author's environment or silently failing in other environments.
The output section specifies message fields in Chinese ('最近一次执行时间', '状态', '详情') without indicating any language choice or user opt-in. This creates a language-policy concern because the skill appears to enforce a specific locale rather than allowing the user to choose or documenting a justified regional limitation.
Lines L10-L14 describe the current notification format using Chinese field labels only, and the file does not indicate that users can choose another language or that the locale restriction is required. Under SQP-3, forcing a specific language without user opt-in can be a natural-language policy violation.
The outgoing message text is branded specifically for Beijing signed-price tracking even though the skill is presented as a generic tracker monitor. This can mislead operators about what system generated the alert and what job status is being reported, increasing the chance of misrouting, confusion during incident response, or unnoticed monitoring gaps.