Security audit
Security checks for vulnerabilities and agentic risk
This skill locally monitors OpenClaw work sessions and todos, writes local status files, and does not show hidden exfiltration, destructive behavior, or real automatic task recovery.
Install only if you are comfortable with a local skill periodically inspecting OpenClaw session metadata and todo files, then storing task labels/status locally in state.json and error.md. Treat the advertised 'automatic recovery' as notification and recommendation only unless future versions add real restart actions.
代码与声明存在实质性偏差。两者有部分重合：代码确实检测了任务超时/消失/失败情况，这与“子代理超时/消失检测”相符。但声明中的核心能力更广，尤其是“自动恢复”和“全量会话监控”。实际实现只是从固定路径读取状态文件，筛选可恢复任务，并把异常写入 error.md，输出提示信息；并未调用任何恢复机制、重启任务、修改任务状态，也没有任何会话级监控或待办事项巡检逻辑。因此描述明显高估了实际能力，属于描述与行为不一致。
整体上，代码与“工作进度检查”主题大体一致：确实包含待办检查、子代理/会话状态同步、超时检查、消失检测和会话状态清理。但描述中的关键能力“自动恢复”并未实现；代码对消失会话仅将状态置为 disappeared，对超时任务仅增加计数并报告 warning，没有任何恢复动作。此外，“全量会话监控”的表述也偏强，而代码实际仅查询 --active 30 范围内会话。故描述高估了实际能力，存在实质性不匹配。
The declared description presents an active monitoring/checking skill with runtime behaviors such as scheduled task inspection, sub-agent failure detection, auto-recovery, and full session monitoring. The supplied code chunk instead only installs filesystem prerequisites by creating daily/weekly memory directories in the user's workspace and emitting status messages. Although mentioning cron in a reminder loosely relates to scheduling, the script itself neither registers nor runs any monitoring logic. Therefore the code chunk's actual purpose is materially different from the declared purpose.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
if (now - notifiedTime > graceMs) {
if (!state.evicted) state.evicted = [];
state.evicted.push({ id: key, evictedAt: new Date().toISOString() });
delete state.tasks[key];
cleaned++;
}
}
The skill declares executable/scripted capabilities and references Node.js scripts plus persistent state, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, undeclared capabilities increase the risk of over-broad execution, environment access, and user surprise because reviewers and runtime policy cannot easily constrain what the skill is allowed to do.
The skill advertises periodic monitoring, state persistence, and logging, but does not clearly warn users that it may continuously inspect sessions and update files such as state.json or error logs. Hidden persistence and monitoring behavior can expose sensitive workflow data, create privacy concerns, and cause unexpected modification of workspace files.
The header describes the tool as performing automatic recovery for timed-out tasks and says it will suggest recovery actions. In the implementation, the script only identifies tasks from state.json and appends a fixed '建议: 重新执行' entry to error.md; it does not restart, requeue, or otherwise recover any task.
The manifest presents a broader capability set including periodic todo checking, sub-agent timeout/disappearance detection with automatic recovery, and full-session monitoring. This script does not perform periodic scheduling or full-session monitoring, and its 'recovery' behavior is limited to writing log entries based on existing state values.
The timestamp formatting forces zh-CN and Asia/Shanghai, which is a natural-language/locale policy issue under the rule because it imposes a specific locale without user opt-in. This can affect output format and readability for users in other locales.
The file’s user-facing description, usage notes, and operational messaging are written entirely in Chinese, and the script also formats timestamps using the zh-CN locale. This imposes a specific language/locale on users and downstream agents without any opt-in, alternative language support, or stated region-specific justification.
The header comment says flags like '--agents', '--cron', and '--children' restrict output to specific check types. In main(), the code parses a mode flag but never uses it; it always calls scanAllSessions() and analyzeSessions() the same way regardless of the selected option.
The manifest description promises '子代理超时/消失检测与自动恢复', implying the skill performs recovery. However, this file only scans sessions, records state, and emits 'recoverable' recommendations such as 'restart_cron' or 'investigate_failed' without actually invoking any restart or recovery operation.
The description advertises 'periodic checking', 'sub-agent timeout detection and auto-recovery', and 'full session monitoring' without any stated limits, consent model, or trigger boundaries. In an agent skill, vague monitoring language can mask overbroad surveillance or autonomous behavior, increasing the risk of unauthorized observation, excessive data access, or disruptive recovery actions.
The natural-language description and headings present the skill in Chinese without indicating that another language can be used or that the locale is intentionally restricted. Under the policy, language or locale constraints should not be imposed without user opt-in or a documented, justified regional limitation.
This code appends task details to memory/error.md, which is a file write affecting user/workspace data. While the script prints a completion message after writing, there is no confirmation prompt or explicit pre-action warning in the executable flow, so users are not informed before the persistent modification occurs.
The script hard-codes toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' }), which forces output formatting to a specific language/locale regardless of user preferences or environment. This is a natural-language policy concern because the file does not offer any language or locale choice or document a justified region-specific constraint.
This code includes user-facing documentation and console output in Chinese only, which imposes a specific language/locale choice on users. The policy allows locale constraints when users are given a choice or when the restriction is clearly justified, neither of which is present here.
The manifest description is written entirely in Chinese and does not indicate that language selection is optional or limited to a justified region-specific use case. This can violate language or locale policy when a skill implicitly forces a specific language without user opt-in.
Detected: suspicious.dangerous_exec