Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed OpenClaw news-monitoring skill that uses network lookups and local state for briefings, with no evidence of hidden exfiltration or destructive behavior.
Install this only if you want your agent to make scheduled or on-demand network checks against GitHub, ClawHub, and web search sources, and possibly deliver results to the configured channel. Review the cron schedule and channel before enabling it, and remove the cron entry or delete the state files if you no longer want ongoing briefings.
The skill schedules recurring external data collection and message delivery via cron, but the description does not clearly warn users that it will perform ongoing network requests and send outbound briefings automatically. That missing disclosure can lead to users enabling persistent monitoring and notifications without understanding the privacy, operational, or cost implications.
The on-demand trigger phrase is very broad (e.g. 'what's new in OpenClaw? or similar'), which can cause the agent to invoke the skill in response to loosely related user messages without clear consent. In this skill, invocation leads to external queries and potentially message delivery, so ambiguous triggering increases the risk of unintended data collection, network access, and noisy or surprise notifications.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_gh(*args):
"""Run a gh CLI command and return parsed JSON."""
try:
result = subprocess.run(
["gh"] + list(args),
capture_output=True, text=True, timeout=30
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def collect_clawhub():
"""Query ClawdHub registry for skills."""
try:
result = subprocess.run(
["clawdhub", "explore", "--registry", "https://www.clawhub.ai"],
capture_output=True, text=True, timeout=30
)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
{
"number": 4908,
"state": "closed",
"title": "fix(daemon): use environment-aware service name resolver in systemd install/uninstall",
"updated": "2026-02-01T12:25:37Z",
"url": "https://github.com/openclaw/openclaw/pull/4908"
},
This code invokes gh api and clawdhub explore to fetch external data and the module docstring says the script is designed to be called directly by an agent. While there are stderr progress messages, there is no explicit user-facing warning that running the script will make outbound service requests to GitHub and ClawdHub, which may matter for privacy or network-restricted environments.
This code path performs a file write to state/briefing.md via tee and only informs the user after the save has already occurred. While the --save flag implies persistence, the script does not provide a visible pre-action disclosure that the existing file may be overwritten.
No suspicious patterns detected.