Natural Language Response

Security checks across static analysis, malware telemetry, and agentic risk

Overview

This is a coherent local response-formatting skill with no credential or network access shown, but users should know it automatically rewrites outgoing replies and keeps local per-session state.

This skill appears safe for its stated purpose, but install it only if you are comfortable with all outgoing replies being automatically reworded. Check the configuration for formality and emoji use, and periodically clear the local state file if topic metadata should not be retained.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Replies may include casual phrasing, fillers, or emoji, which can affect tone and perceived professionalism.

Why it was flagged

The skill automatically changes every outgoing reply before the user sees it. That is the stated purpose, but it can make the assistant seem more human or casual than the underlying response.

Skill content
该技能是**自动应用**的,无需手动调用。它会拦截所有发送给用户的回复,自动进行格式化处理。
Recommendation

Use it only if you want automatic tone rewriting; raise formal_level or disable the skill for formal, legal, financial, or sensitive conversations.

What this means

Local state may retain small pieces of conversation context and influence later formatting decisions.

Why it was flagged

The skill stores per-session conversation metadata and a current-topic value in a local memory file to decide when to greet or change tone.

Skill content
"last_message_time": "2026-03-10T16:12:45", "current_topic": "股票查询", "greeting_count": 3
Recommendation

Review or clear memory/reply_state.json periodically, especially if conversations may contain sensitive topics.

What this means

Running the installer modifies the local OpenClaw skills directory.

Why it was flagged

The package includes a shell installer that creates the local skills directory and copies the skill there. It does not show remote downloads, privilege escalation, obfuscation, or automatic execution.

Skill content
mkdir -p "$OPENCLAW_SKILLS" ... cp -r . "$OPENCLAW_SKILLS/human-like-reply"
Recommendation

Run the installer only from the intended skill directory, or manually copy the files if you prefer to avoid shell installation scripts.