Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently creates and maintains local person profiles, with user approval required before bulk edits.
Select only the intended profile directory and keep a backup. Run heading migration with --dry-run before approving changes; its report gives file counts rather than a detailed preview. Treat benchmark suggestions about email access or publishing as separate decisions, and review private material before sharing it with AI or publicly.
Without declared permissions the skill's intent is opaque and cannot be validated.
This actionable recommendation tells the reader to consolidate three months of reading, writing, and thoughts, work on that material with AI, and publish a selected portion. It provides no warning to exclude sensitive personal information, confidential work, or third-party material before AI processing or public disclosure.
L221 explicitly recommends implementing email and social-feed scanning in the user's OpenClaw setup, rather than merely describing another person's tools. The file does not warn that this gives AI workflows access to potentially sensitive messages and account content; the manual-confirmation requirement at L141 does not explain that privacy exposure.
The instruction “中文优先：档案正文用中文” explicitly sets Chinese as the output language for dossier content. The file offers no user language choice or justification for a locale-specific requirement.
L14 promises to list all locations that will be modified before execution. Instead, migrate_file writes changes immediately at L67–L68, and the caller only prints a filename and change count afterward at L103–L107. This contradicts an explicit safety assurance for a bulk-edit operation; users receive neither a pre-write preview nor the promised location details.
No suspicious patterns detected.
