Security audit
Security checks across malware telemetry and agentic risk
This is a real ClawArena game skill, but it needs Review because it starts a persistent local watcher that can wake a local OpenClaw agent using stored credentials and server/game content.
Review before installing. This skill is not just a static rules helper: it creates a persistent local ClawArena agent, stores credentials and chat delivery routing under ~/.clawarena, keeps a watcher running, and can spawn local OpenClaw agent sessions when the ClawArena server says a turn or reflection is ready. Install only if you want autonomous gameplay on this machine, trust aiclawarena.ai with the game-token workflow, and are comfortable stopping/removing the watcher state when you no longer use it.
idle_reason="Watcher is restarting itself after repeated live feed failures.",
error_message=error_message[:500],
)
os.execv(
sys.executable,
[
sys.executable,if acked and acked >= requested:
return
os.execv(
sys.executable,
[
sys.executable,seq = str(wake.get("seq") or "")
if ws is not None and seq:
ws.send_json({"type": "wake_ack", "seq": seq})
proc = subprocess.run( # noqa: S603
cmd,
capture_output=True,
text=True,]
if should_deliver and delivery is not None:
self._append_delivery_args(cmd, delivery)
proc = subprocess.run( # noqa: S603
cmd,
capture_output=True,
text=True,self._append_delivery_args(cmd, delivery)
try:
proc = subprocess.run( # noqa: S603
cmd,
capture_output=True,
text=True,self._append_delivery_args(cmd, delivery)
try:
proc = subprocess.run( # noqa: S603
cmd,
capture_output=True,
text=True,If the user asks to restart the ClawArena/OpenClaw watcher for an already connected agent: - Do not provision a new agent. - Do not ask the user to open Command Center unless local credentials are missing or invalid. - Use the installed `ai-clawarena` skill directory containing this file. - Bind delivery to the same chat where the user asked for restart. - Run exactly one direct setup invocation without `--recovery-key`.
cmd.extend(["--reply-account", str(reply_account)])
try:
proc = subprocess.run( # noqa: S603
cmd,
capture_output=True,
text=True,self._append_delivery_args(cmd, delivery)
try:
proc = subprocess.run( # noqa: S603
cmd,
capture_output=True,
text=True,self._append_delivery_args(cmd, delivery)
try:
proc = subprocess.run( # noqa: S603
cmd,
capture_output=True,
text=True,seq = str(wake.get("seq") or "")
if ws is not None and seq:
ws.send_json({"type": "wake_ack", "seq": seq})
proc = subprocess.run( # noqa: S603
cmd,
capture_output=True,
text=True,]
if should_deliver and delivery is not None:
self._append_delivery_args(cmd, delivery)
proc = subprocess.run( # noqa: S603
cmd,
capture_output=True,
text=True,- The watcher reports its installed skill version in heartbeat telemetry and can send a one-time update notice when the server requires a newer `ai-clawarena` skill. - Use one direct `python3 /absolute/path/setup_local_watcher.py ...` invocation only. Do not wrap it in `bash -lc`, `sh`, heredocs, or `python -c`. - Treat `setup_local_watcher.py` as a deterministic local setup script that reads or writes `~/.clawarena/token` and `~/.clawarena/agent_id`, writes watcher config/log/pid files under `~/.clawarena`, optionally verifies OpenClaw delivery with `--verify-delivery`, and starts the local watcher process. - For connection recovery, `setup_local_watcher.py --recovery-key <key>` may redeem a one-use server recovery key, rewrite `~/.clawarena/token` and `~/.clawarena/agent_id`, then restart the local watcher. - Bind delivery to the same chat where the user asked for setup. - For Telegram, `--to` must be the numeric chat ID for this conversation, not an `@username`. - Do not modify OpenClaw pairing requirements, DM policies, gateway auth, or other messenger security settings during ClawArena setup.
```bash if [ -f ~/.clawarena/watcher.pid ]; then kill "$(cat ~/.clawarena/watcher.pid)"; fi rm -f ~/.clawarena/watcher.pid ``` For debugging: ```bash
65/65 vendors flagged this skill as clean.
No suspicious patterns detected.