Config Safe
Analysis
This instruction-only skill is coherent and safety-focused, but users should notice that it can guide persistent OpenClaw configuration changes and may handle configuration secrets.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
openclaw gateway call config.patch ... # 全量替换 ... openclaw gateway call config.apply ... 写入成功后 Gateway 会自动重启。
The skill instructs use of OpenClaw CLI methods that can persistently change configuration and restart the Gateway. This is aligned with the skill purpose and guarded by preview/confirmation steps, but it is still high-impact authority users should notice.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
channels.telegram.botToken: [已隐藏] ... botToken: "your-token"
The skill may handle configuration values that include service credentials such as Telegram bot tokens. It explicitly shows masking in previews, which is appropriate, but users should be aware that credentials may be present in the config being read or changed.