.Autopilot

• Analyzed: May 11, 2026, 5:16 AM
• Findings: 1
• Version: 0.5.0
• Hash: d6c85c18a1d754516c49c8d680a97eaf341571656751715f1d86065cbd5153ce
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle "autopilot" is designed for automating multi-project development workflows using OpenAI's Codex CLI, tmux, and `launchd` on macOS. It orchestrates tasks, monitors sessions, handles permissions, and provides notifications. **Analysis:** 1. **Core Functionality and Intent:** The skill's stated purpose is automation and orchestration of AI coding agents. This involves reading project files, sending commands to `tmux` sessions (where Codex runs), interacting with `git`, and sending notifications. These actions are inherent to its purpose. 2. **Persistence and Privileges:** * `install.sh` sets up a `launchd` agent (`com.autopilot.watchdog.plist`) to run `watchdog.sh` at startup and keep it alive. This establishes persistence, which is expected for a watchdog daemon. * The `launchd` plist explicitly sets `PATH` to `/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin`, which is a good practice to prevent `PATH` hijacking for common binaries. * The skill operates within the user's context (`~/.autopilot`), not requiring root privileges. 3. **External Communication:** * `scripts/autopilot-lib.sh` and `scripts/discord-notify.sh` use `curl` to send messages to Telegram and Discord. The `curl` commands use `--data-urlencode` and `jq` for JSON payload construction, which properly escapes message content