Skill Priority Setup

PassAudited by ClawScan on May 10, 2026.

Overview

No malicious behavior is evident, but this skill persistently changes OpenClaw skill-injection and agent configuration, so users should review changes before applying them.

This skill appears purpose-aligned and not malicious based on the provided artifacts. Before installing or running it, use --dry-run, avoid --auto on first use, and review the generated changes to AGENTS.md, SOUL.md, message injector configuration, and SKILL_PRIORITY_POLICY.md.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Using --auto may apply default priority tiers and configuration changes that affect future OpenClaw behavior.

Why it was flagged

The setup wizard has an explicit auto mode that bypasses interactive tier review before configuration is applied. This is disclosed and user-invoked, but it can change agent behavior without per-change confirmation.

Skill content

if self.auto_mode:
            print_section("Phase 3: Auto-Mode (Skipping Review)")
            return True

Recommendation

Prefer --dry-run or the interactive mode first, then review proposed tier assignments and generated configuration before applying.

Info

#ASI05: Unexpected Code Execution

What this means

Running the script gives it the ability to inspect OpenClaw skill directories and write OpenClaw configuration files.

Why it was flagged

The skill requires running a local Python setup script. This is central to the stated purpose and not hidden, but it is still local code execution.

Skill content

python3 ~/.openclaw/workspace/skills/skill-priority-setup/scripts/setup.py

Recommendation

Run it only from the installed skill directory you trust, and use --dry-run before allowing changes.

Low

#ASI06: Memory and Context Poisoning

What this means

Generated or modified agent instructions may affect future sessions beyond the initial setup run.

Why it was flagged

The skill modifies persistent files that can influence future agent context and behavior. This is expected for a skill-injection policy tool, but persistent instructions should be reviewed.

Skill content

AGENTS.md updates: Core constraints added
- `SOUL.md` updates: Agent evolution behaviors

Recommendation

Review AGENTS.md, SOUL.md, and SKILL_PRIORITY_POLICY.md after running the tool, and keep the generated backups for rollback.