Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed OpenClaw security-audit workflow, with some broad triggers and report-writing behavior users should understand before use.
Use this skill when you explicitly want an OpenClaw security review. Before running it, expect it to inspect OpenClaw configuration and skill directories and to create a local report; approve any suggested gateway configuration changes only after reviewing the exact patch.
The trigger list is broad and includes common phrases like '帮我检查安全', '扫描风险', and especially '工信部', which can easily appear in unrelated conversations. This creates a high risk of accidental activation, causing the skill to run security-scanning logic and potentially inspect configuration, local files, or generate reports without the user specifically intending to invoke this skill.
The activation rule uses '等关键词', leaving scope undefined and encouraging fuzzy matching beyond the listed phrases. In a skill that performs security checks and may enumerate sensitive paths or write reports, ambiguous activation increases the chance of unintended execution and surprise access to local environment details.
The skill instructs creation of a security report file at a specific workspace path but does not clearly notify the user beforehand that a file will be written. Even though the file is a report, silent workspace writes can surprise users, leak environmental details into persistent storage, or overwrite expected note locations if naming collisions or automation occur.
No suspicious patterns detected.
