Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed deployment methodology with example configuration files and no executable payload, but users must implement its destructive deploy and privacy guards carefully.
Installers should treat this as a checklist for building their own deployment kit, not as a ready-made generator. Before using it live, verify that any generator you write refuses unresolved sentinels, protects secrets, avoids unguarded deletes or overwrites, requires explicit deploy approval, and has a real legal basis and retention job for any inbound DM data.
The manifest description says to trigger on "the agent named the wrong client," which is a broad natural-language complaint rather than a narrowly scoped invocation. Without clearer activation boundaries or exclusion conditions, this could cause unintended invocation in general troubleshooting conversations about agents.
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
| **Own a directory before you wipe it.** Write an ownership marker when you create `out/`; refuse any `out/` lacking it. | `out/` is the default build dir of tsc, next export and webpack. "Rebuilt from scratch every run" reads as hygiene and executes as `rm -rf` on a stranger's build tree. |
| **One guard function, called from every destructive path.** Count your `rmSync`/`renameSync` call sites, not your guards. | The obvious path refuses, a sibling entry point still wipes. Reproduced: a foreign `out/dist/bundle.js` survived a plain render (exit 1) and was destroyed by the purge path (exit 0) — the purge reached its own `rmSync` through an early exit, *before* the guard line. The path that bites is never the one you tested. |
| **Require an install marker before overwriting.** Refuse `$HOME`, refuse `/`, refuse a target with no `openclaw.json`; back up to `<home>.bak-<ISO>` first. | The marker test is the only thing between a typo (`~/Documents` for `~/Documents/.agent`) and a renamed real folder. `renameSync` never asks. |
| **Set modes on the destination, after write *and* after the copy:** 0700 dirs, 0600 files, 0700 `.sh`. | A rendered file is a **new** file at the umask (0644) — rendered secrets land world-readable. A copy carries bytes, not modes: the chmod you did before it is gone. Fails weeks later as `permission denied`, or never, which is worse. |
| **Deploy is opt-in; default stops at `out/`** so a human reads it first. | Anything else makes review theatre. |
The sentinel gate is the one to get right, since it is the only thing standing between an unknown legal basis and a live agent reading DMs. The shape — an example to adapt, not a drop-in:
The configuration sets "LANGUAGE": "en" as a fixed value, which is a natural-language policy concern when no user opt-in, language choice, or justification for the restriction is provided. This can cause the skill to force a specific language regardless of user preference or locale.
This manifest-style JSON describes the scope as "inbound DM triage on two platforms" and lists what is not sold, but it does not define clear activation triggers or concrete boundaries for when the skill should engage versus abstain. Because this is a manifest-like file and trigger scope is only described at a high level, the lack of explicit trigger phrases or exclusion examples could lead to ambiguous invocation.