Agent Andri

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to do what it says—append a simple status message to a local meeting-room file—but users should notice that the script runs indefinitely and the documentation mentions an unused API key.

Before installing or running, confirm you want a continuously running status reporter that appends to the meeting-room file every 30 seconds. Stop the process when reporting is no longer needed, and do not provide the mentioned NV_API_KEY unless you have reviewed an additional component that truly needs it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If run and left active, it can keep writing to the status file indefinitely, growing the file over time.

Why it was flagged

The script intentionally keeps running and appends a status message every 30 seconds. This is purpose-aligned, but it can continue until manually stopped.

Skill content
while true; do ... echo "[$ts] $AGENT_NAME : sedang idle" >> "$TO_LEADER" ... sleep 30
Recommendation

Run it only when continuous reporting is desired, and consider adding a stop condition, supervisor controls, or log rotation.

What this means

Other agents or workflows that read the meeting-room file may consume whatever this script appends. The current script only writes a simple idle status.

Why it was flagged

The script writes into a meeting-room skill workspace file, which is likely intended as an inter-agent communication channel.

Skill content
BASE_DIR="$HOME/.openclaw/workspace/skills/meeting-room"
TO_LEADER="$BASE_DIR/to_leader.txt"
Recommendation

Confirm the meeting-room file is the intended shared channel and avoid modifying the script to write secrets or sensitive content there.

What this means

Providing an unnecessary API key would increase exposure without benefiting the included status-reporting script.

Why it was flagged

The documentation mentions an agent API key even though the included script does not use it and the registry declares no primary credential.

Skill content
`NV_API_KEY` – API-key khusus agen (tidak dipakai di contoh ini, hanya disimpan bila diperlukan).
Recommendation

Do not supply NV_API_KEY for this skill unless a separately reviewed, necessary component requires it.