Security audit
task-orchestrator
Security checks for vulnerabilities and agentic risk
Overview
The skill's files, instructions, and requirements are consistent with a task‑orchestration utility that uses the openclaw CLI to create heartbeats, cron jobs, and subagent plans; it does not request unrelated credentials or include remote install downloads.
This skill appears internally consistent and matches its stated purpose, but review these items before enabling or granting it autonomous use: - Ensure the openclaw CLI is the correct tool you want to allow the skill to call. The skill uses 'openclaw cron add' and similar commands to create scheduled jobs. - Before running any auto‑execution flows, replace placeholders in templates ({YOUR_USER_ID}, {CHANNEL}) and test with a harmless task to confirm behavior. - Check where files are written (~/.openclaw/workspace/memory and the skill's config path). Back up any important files if you rely on those paths. - If you are uncomfortable with the agent autonomously scheduling jobs or dispatching subagents, disable autonomous invocation for this skill or require explicit confirmations in your agent policy. - If you expect integrations with external APIs (e.g., GitHub, email), verify how credentials will be provided; this skill does not declare any credential handling and will need safe configuration for external services. If you want, I can list specific lines in scripts/utils.py that read/write files or show the exact openclaw command examples to review them more closely.
Static analysis
No suspicious patterns detected.