Security checks across malware telemetry and agentic risk
The skill’s default doctor entrypoint is mostly diagnostic, but it silently loads local secrets, bootstraps packages, and ships a broader benchmark runner with shell execution and upload paths that are not well scoped in the doctor-facing description.
Install only if you are comfortable with a doctor tool that contacts the GIGO API, checks a local OpenClaw gateway, may create a managed Python runtime and install packages, and may read OpenClaw secrets.env into its environment. Treat the packaged full benchmark runner as broader than the doctor label and avoid invoking main.py or setting GIGO_V2_AGENT_COMMAND unless you intentionally want that behavior.
break
# 执行
try:
proc = subprocess.run(
cmd, shell=True, cwd=str(self.workdir),
capture_output=True, timeout=timeout, text=True,
)runner_path = workdir / "_cov_runner.py"
runner_path.write_text(runner)
try:
proc = subprocess.run(
[sys.executable, str(runner_path)],
cwd=str(workdir), capture_output=True, timeout=40, text=True,
)print("Type a Python expression:")
expr = input("> ")
result = eval(expr)
print("Result:", result)"-r",
str(status.requirements_path),
]
completed = subprocess.run(
command,
capture_output=True,
text=True,profile_argv = None
effective_argv = profile_argv if isinstance(profile_argv, list) else sys.argv[1:]
argv = [str(runtime_python), str(skill_root / "main.py"), *[str(item) for item in effective_argv]]
os.execve(str(runtime_python), argv, env)
def ensure_runtime(skill_root: Path, lang: str = "zh") -> RuntimeStatus:started = time.time()
try:
completed = subprocess.run(
command,
shell=True,
cwd=str(workdir),print("Type a Python expression:")
expr = input("> ")
result = eval(expr)
print("Result:", result)started = time.time()
try:
completed = subprocess.run(
command,
shell=True,
cwd=str(workdir),66/66 vendors flagged this skill as clean.