Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marked this skill suspicious because scanners report that it updates the local OpenClaw installation across release channels, a state-changing capability outside its announcement-focused purpose.
Consider the reported OpenClaw updates and their lack of interactive confirmation before installing. The scan is partial: two local references could not be resolved, so evidence is incomplete. A separate scan completed without findings, but that does not rule out risks.
The declared purpose is release-announcement preparation or posting, but the code instead performs a local software update. Displaying the version could support release validation, but changing the installed software is an undeclared state-changing capability. The supplied code does not draft or post an announcement.
Checking the installed version could support release validation, but executing an update changes the local installation rather than drafting or posting an announcement. This is a materially different capability not disclosed in the declared purpose.
Checking the installed version could support release validation, but performing an automatically confirmed software update is a distinct, state-changing capability not disclosed by the announcement-focused description. The supplied chunk does not draft or post an announcement.
