Security audit
Security checks across malware telemetry and agentic risk
This literature-report skill mostly matches its stated purpose, but it also automatically uses broad shell-loaded credentials and sends or persists reports to several destinations, including an under-disclosed Matrix channel.
Install only if you want report generation to also update shared Zotero data, persist facts into OpenClaw memory, copy files into workspace locations, and potentially send the report to Matrix. Use a limited Zotero API key, verify the group ID and helper scripts, and avoid scheduled runs unless every outbound and persistent side effect is intended.
"""从 ~/.zshrc 加载环境变量，返回更新后的 env dict"""
env = os.environ.copy()
try:
result = subprocess.run(
["bash", "-l", "-c", "env"],
capture_output=True, text=True, timeout=10
)fact += f" | URL: {url}"
# 调用 kg.py add
result = subprocess.run(
["python3", KG_SCRIPT, "add",
"--entity", entity,
"--fact", fact,fact += f" | URL: {url}"
# 调用 kg.py add
result = subprocess.run(
["python3", KG_SCRIPT, "add",
"--entity", entity,
"--fact", fact,64/64 vendors flagged this skill as clean.
No suspicious patterns detected.