Security audit
Security checks for vulnerabilities and agentic risk
This is a transparent collaboration-memory skill, but users should know it may save preference and correction history persistently.
Install only if you are comfortable with the agent remembering collaboration preferences, corrections, and friction patterns across sessions. Avoid putting sensitive personal, business, or credential details into correction examples unless you understand where your OpenClaw memory is stored and how to delete it.
The README states that the skill 'automatically learns user preferences' but does not clearly warn users that this may create persistent records derived from their interactions. In an AI assistant context, preference memory can capture sensitive behavioral, workflow, or potentially personal data, so lack of explicit disclosure creates privacy and consent risk.
The 'Memory Sync' feature explicitly says learnings are saved to persistent storage, but the README does not explain what information is stored, where it is stored, or the privacy implications. Because the skill is designed to record corrections and friction points over time, persistent storage could accumulate sensitive user data without informed consent or clear retention controls.
The skill explicitly describes saving collaboration preferences, correction history, and friction patterns via a memory tool, but it does not clearly warn users that this data may be persistently stored or explain retention/consent boundaries. This creates a privacy and trust risk because users may disclose behavioral preferences or interaction history without realizing it will be remembered beyond the current session.
The prominent tagline is written in Chinese, which may imply a language preference or locale assumption, but the file does not state whether multilingual use is supported or whether Chinese is intentional for a region-specific audience. Under the language/locale policy, forcing or implying a specific language without user opt-in can be problematic.
The skill description and operating instructions are written exclusively in Chinese, which can amount to a language policy violation when no language selection or user opt-in is provided. There is no indication that the skill is region-specific or that users may choose another language.
No suspicious patterns detected.
