Security audit
Security checks for vulnerabilities and agentic risk
This is a local time-tracking and efficiency-planning skill that stores activity records on the user's machine, with some state-changing support commands that are disclosed but should be used deliberately.
Install only if you are comfortable with a local activity log being stored under ~/.openclaw and shared across agents on the same machine. Use delete and config commands only with clear intent, and treat the planning output as a lightweight draft rather than a calendar-grade optimizer.
The declared behavior emphasizes coaching, planning, and review, but the documented command surface includes undeclared state-changing capabilities such as config manipulation and deletion of stored events. This mismatch can mislead users or higher-level orchestrators into invoking a skill with broader destructive or privacy-relevant effects than its description suggests.
The documentation exposes a destructive delete capability without clearly warning about irreversibility, confirmation expectations, or backup/recovery behavior. In an agent-driven workflow, unclear destructive operations increase the risk of accidental data loss, especially if another component invokes support commands based on docs alone.
This markdown file lists delete as an available local CLI command but provides no warning that it may remove stored history or otherwise affect user data. For a skill description, destructive capabilities should be accompanied by clear user-facing caution so agents and users understand the risk before invoking them.
The skill declares local data storage and references command surfaces with configuration and event operations, but it does not declare an explicit tool/permission scope. That makes the effective capabilities less transparent to the platform and user, increasing the risk of unintended environment or filesystem access beyond what a productivity skill appears to need.
The activation description is broad enough to match many ordinary productivity conversations, which can cause the skill to trigger in contexts where the user did not intend persistent local logging or analysis. In this skill, that is more concerning because the same document later states that activity data is stored locally in a shared store across agents.
The usage guidance lists many broad conversational triggers without scope limits, encouraging the agent to use the skill for general planning or reflection requests. Because the skill persists activity data locally, over-broad invocation raises privacy and consent risks and may lead to unnecessary writes or analysis of user behavior.
The skill explicitly states that user activity data is stored locally in a shared store across agents, but it provides no warning about persistence, data retention, or cross-agent visibility. This creates a privacy risk because sensitive work patterns, task names, and timing data may be retained or accessed longer and more broadly than users expect.
The function maps time slots directly to Chinese labels, and later user-facing suggestion titles and descriptions are also emitted in Chinese. This indicates the skill produces a fixed locale experience without any visible user choice or documented locale constraint in this file.
Multiple suggestion titles, descriptions, and action steps are hard-coded in Chinese. Forcing a single language in user-facing natural language can violate language/locale policy when there is no opt-in or documented regional justification.
The category keyword lists and later user-facing warning/reason strings are written primarily in Chinese, which effectively biases the skill toward Chinese-language input and output. Because the file does not offer a language/locale opt-in or document that this is a China/Chinese-specific skill, this creates a natural-language locale policy issue.
The function is presented as choosing a next available or preferred time slot, but it ignores both actual availability and the preferredSlot parameter and simply returns the provided start time. In an efficiency-planning skill, this can mislead users into trusting schedules that overlap commitments, violate configured boundaries, or fail to honor intended optimization logic.
The scheduling routine advertises task scheduling with options and category-aware preferences, but it actually chains tasks sequentially from day start without considering user options, availability, or realistic placement. This creates integrity risk in the skill's core function because users may act on inaccurate plans that appear optimized or personalized but are not.
The warning at L204 and the rationale strings in getScheduleReason are user-facing text in Chinese only. Forcing a specific language in generated output without opt-in or documented locale scope matches the language/locale policy violation criteria.
This file includes hard-coded Chinese comments and user-facing category names such as 工作, 学习, and 娱乐, with no indication that the user can choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.
The function deleteAllEvents clears all persisted event data by writing an empty array to events.json. Although the comment names the operation, there is no confirmation prompt, user-visible log/print, or other disclosure in this code path to warn that all stored data will be erased.
This markdown file documents a delete action as an available internal/public capability but does not include any warning that it may remove user data or be irreversible. For markdown files, safety-affecting behaviors should be disclosed so users understand the impact before invoking the skill.
The wrapper documentation explicitly states that delete/config/analyze are not exposed, but the CLI entrypoint still dispatches those actions when the action name is provided. This creates a misleading trust boundary: an agent or user relying on the documented interface may unknowingly invoke destructive or state-mutating functionality, enabling unauthorized deletion or configuration changes through the same executable.
This skill is described as an efficiency coaching and planning tool, but the wrapper includes hidden capabilities to delete stored events and mutate configuration. In agent ecosystems, excess capability beyond the declared purpose increases the risk of misuse, prompt-injection chaining, or unintended destructive actions because consumers may grant it broader trust than warranted.
The delete action removes events immediately based only on an ID and provides no confirmation, dry-run mode, or user-facing warning. In an agent-driven context, that makes accidental or induced destructive operations more likely, especially because the action is reachable despite being described as internal-only.
The config action allows arbitrary key/value writes to persisted configuration with no validation, authorization, or scope restriction. Even if this wrapper is intended for local use, arbitrary state mutation can alter behavior, corrupt settings, or create a stepping stone for further abuse depending on how configuration is consumed elsewhere in the skill.
The help text labels analyze/delete/config as 'Internal only' and 'not exposed', yet the program still accepts those action names and executes them. That discrepancy is dangerous because it conceals reachable functionality, which can be abused by callers that inspect or guess commands rather than trusting the help output.
This code presents user-facing examples and prompts in Chinese, and the rest of the CLI output throughout the file is likewise hard-coded to that locale. The skill does not offer any user opt-in, language selection, or documented justification for restricting interaction to Chinese, which fits the language/locale policy violation criteria.
Lines L005-L010 say the product is 'moving from a local time tracker toward a local execution coach' and that only logging and review are already implemented. This directly contrasts with the broader coaching-oriented positioning in the surrounding documentation and indicates the docs acknowledge a gap between intended product behavior and actual implementation.
The table lists suggest-next among conceptual product modes, but L041 states it is only 'derived manually' and 'not yet a dedicated command.' This is an intent-versus-implementation mismatch in the documentation because it frames a capability as part of the supported surface while admitting no actual command exists.
The documented examples and compatibility notes consistently use Chinese task descriptions and categories, and the file notes normalization for some Chinese categories. Because the documentation does not state that the skill is China/Chinese-specific or offer user language choice, this can be read as a language/locale assumption in the skill surface.
No suspicious patterns detected.
