Analysis

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:18 PM UTC
• Version: 1.0.2

Overview

The skill is a coherent local health-audit guide, but its credential-search examples can expose real secrets in command output despite promising not to show credential values.

Review before installing. This skill is meant to inspect sensitive local agent setup data and keep local audit records. It should not be used for credential scanning until the raw git grep and git log -p examples are replaced with a redacting scanner that emits only file, line, credential kind, and safe metadata. I found no evidence of external exfiltration, hidden install behavior, or destructive automatic actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: secrets.md:67

Finding

Secret-scanning commands can disclose credential values into agent output and session transcripts

Content

View full analysis

Vulnerability Details

File Location: secrets.md, lines 67–70
Vulnerability Type: Sensitive information exposure through unsafe secret-scanning output
Risk Level: High

Complete Code Snippet

markdown

## Git History

- Present in the current tree: `git grep -n -I -e '<pattern>'`.
- Present in any past commit: `git log -p --all -S'<pattern>' --pickaxe-regex` — `-S` finds commits where the count of matches changed, which is exactly "added or removed".
- When it was added, for the access-log window: `git log --diff-filter=A --format='%H %ad' -- <path>`.
- Whether it left the machine: `git remote -v`, then whether the containing commit is an ancestor of any remote branch (`git branch -r --contains <sha>`).

This behavior conflicts with the security guarantee in SKILL.md, line 222:

markdown

**Credentials:** this skill searches for credentials in order to report their location. It does NOT read, print, copy, transmit, or store any credential value, does NOT write a credential into `~/Clawic/data/`, and never rotates or revokes anything on the user's behalf without an explicit instruction. Findings carry file, line, and kind only.

Technical Analysis

The recommended Git commands are not output-safe for secret detection:

• git grep -n prints the complete matching source line. If the search pattern matches a credential prefix, the output can contain the full usable credential.
• git log -p prints complete historical patches, including lines that added or removed credentials.
• Report-level instructions not to quote secrets do not prevent the underlying tool output from entering the model context, session transcript, command log, or other diagnostic storage.
• The issue therefore occurs before final-report redaction and directly contradicts the Skill's assertion that credential values are never read or printed.

The Skill does not instruct the agent to transm ...[truncated 1523 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace line- and patch-producing searches with a local redacting scanner that emits only:
   • relative file path;
   • line number;
   • credential type or prefix family;
   • commit identifier when relevant;
   • a non-sensitive fingerprint if correlation is necessary.
2. Do not return matched substrings, complete lines, surrounding context, or patches to the model.
3. For current-tree scanning, use a wrapper that performs matching locally and converts each hit to sanitized metadata before writing to standard output.
4. For history scanning, inspect commit blobs or diffs through the same redaction layer; never expose raw git log -p output.
5. Ensure the wrapper also sanitizes standard error, exceptions, debug logs, and temporary files.
6. Add automated tests containing synthetic credentials and verify that no complete value or reconstructable fragment appears in tool output, transcripts, reports, logs, or audit memory.
7. Document the safe scanner as the only permitted credential-content inspection mechanism and remove the unsafe raw Git command examples.
8. Continue requiring rotation before repository or history cleanup when a genuine credential is found.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (41)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: Analysis
slug: analysis
version: 1.0.2
description: Audits an AI agent's own setup — workspace, config, memory, skills, jobs, integrations — and reports what is broken, exposed, or wasteful. Use when asked to check the system, run a health check, or diagnose the setup, or when something feels off or the agent got slow or expensive; when a token, key, or .env may be exposed in a file, config, or git history; when permissions or auto-approve rules look too broad; when a scheduled job stops firing, runs twice, or fails silently; when sessions or subagents pile up or loop; when memory files bloat, go stale, contradict, or fall out of their index; when skills collide, never activate, or point at missing files; when an integration returns 401 or 429 or goes quiet; when token spend or context size jumps; and when the same finding keeps coming back. Not for vetting third-party skill code (`skill-audit`), workspace persona and proactivity tuning (`openclaw-workspace`), application monitoring (`monitoring`), or statistical analysis of a dataset.
homepage: https://clawic.com/skills/analysis
changelog: "Clearer disclosure of what is stored and where"
metadata:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

**Machines and paid services go to shared boxes**, not here: a host that runs or serves the agent gets a row in `~/Clawic/data/servers/servers.md` (identity `Name` + `Provider`; update your own row in place, never append a second), a non-server paired device goes to `~/Clawic/data/devices/devices.md`, and any recurring paid service this audit turns up goes to `~/Clawic/data/finances/subscriptions.md` with its amount and currency. Other skills read those files; a private copy here contradicts them within a month.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in text the user pastes in to be saved, and least of all inside a finding that quotes the line where the secret was found. Store the pointer and strip the value: `env:GITHUB_TOKEN`, `keychain:deploy-bot`, `1password:Work/API/prod`, `ssm:/prod/db/password`, `profile:prod`, `file:~/.ssh/id_ed25519`. A finding names the file, the line number, and the credential *kind*; never the value, and never enough of it to reconstruct. If data sits at an old location (`~/analysis/` or `~/clawic/analysis/`), move it to `~/Clawic/data/analysis/`, and say in one line that you moved it and from where.

An audit is worth its tokens only if it changes what happens next. Every finding carries the evidence that produced it, a severity from the rubric, and exactly one action; a finding with no action is dropped, not downgraded. Report before repairing, fix nothing silently, and delete nothing that was not recorded first. Work from defaults immediately: never open with questions about their setup, their thresholds, or how aggressive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` (shared universals: locale, timezone, currency) → the Configuration table default.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 59)May include surrounding context.

md

**Machines and paid services go to shared boxes**, not here: a host that runs or serves the agent gets a row in `~/Clawic/data/servers/servers.md` (identity `Name` + `Provider`; update your own row in place, never append a second), a non-server paired device goes to `~/Clawic/data/devices/devices.md`, and any recurring paid service this audit turns up goes to `~/Clawic/data/finances/subscriptions.md` with its amount and currency. Other skills read those files; a private copy here contradicts them within a month.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in text the user pastes in to be saved, and least of all inside a finding that quotes the line where the secret was found. Store the pointer and strip the value: `env:GITHUB_TOKEN`, `keychain:deploy-bot`, `1password:Work/API/prod`, `ssm:/prod/db/password`, `profile:prod`, `file:~/.ssh/id_ed25519`. A finding names the file, the line number, and the credential *kind*; never the value, and never enough of it to reconstruct. If data sits at an old location (`~/analysis/` or `~/clawic/analysis/`), move it to `~/Clawic/data/analysis/`, and say in one line that you moved it and from where.

An audit is worth its tokens only if it changes what happens next. Every finding carries the evidence that produced it, a severity from the rubric, and exactly one action; a finding with no action is dropped, not downgraded. Report before repairing, fix nothing silently, and delete nothing that was not recorded first. Work from defaults immediately: never open with questions about their setup, their thresholds, or how aggressive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` (shared universals: locale, timezone, currency) → the Configuration table default.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 245)May include surrounding context.

md

**Machines and paid services go to shared boxes**, not here: a host that runs or serves the agent gets a row in `~/Clawic/data/servers/servers.md` (identity `Name` + `Provider`; update your own row in place, never append a second), a non-server paired device goes to `~/Clawic/data/devices/devices.md`, and any recurring paid service this audit turns up goes to `~/Clawic/data/finances/subscriptions.md` with its amount and currency. Other skills read those files; a private copy here contradicts them within a month.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in text the user pastes in to be saved, and least of all inside a finding that quotes the line where the secret was found. Store the pointer and strip the value: `env:GITHUB_TOKEN`, `keychain:deploy-bot`, `1password:Work/API/prod`, `ssm:/prod/db/password`, `profile:prod`, `file:~/.ssh/id_ed25519`. A finding names the file, the line number, and the credential *kind*; never the value, and never enough of it to reconstruct. If data sits at an old location (`~/analysis/` or `~/clawic/analysis/`), move it to `~/Clawic/data/analysis/`, and say in one line that you moved it and from where.

An audit is worth its tokens only if it changes what happens next. Every finding carries the evidence that produced it, a severity from the rubric, and exactly one action; a finding with no action is dropped, not downgraded. Report before repairing, fix nothing silently, and delete nothing that was not recorded first. Work from defaults immediately: never open with questions about their setup, their thresholds, or how aggressive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` (shared universals: locale, timezone, currency) → the Configuration table default.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

| Findings are in; what can be fixed now | Reversibility test, order of operations, verify by re-running the detection | `remediation.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

| Findings are in; what can be fixed now | Reversibility test, order of operations, verify by re-running the detection | `remediation.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

| Findings are in; what can be fixed now | Reversibility test, order of operations, verify by re-running the detection | `remediation.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md

| Findings are in; what can be fixed now | Reversibility test, order of operations, verify by re-running the detection | `remediation.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md

| Findings are in; what can be fixed now | Reversibility test, order of operations, verify by re-running the detection | `remediation.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

md

| Findings are in; what can be fixed now | Reversibility test, order of operations, verify by re-running the detection | `remediation.md` |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · integrations.md (reported line 34)May include surrounding context.

md

## Scope Failures That Look Like Missing Objects

A valid token plus a 404 on a resource the user can see in the browser is almost always a missing scope: the API refuses to confirm the resource exists to a caller not allowed to see it. Diagnose by calling the identity endpoint and reading the token's granted scopes, then compare against the operation. Never "fix" it by widening to a full-access token — that trades a broken feature for a `permissions.md` finding.

## Expiry Calendar

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · permissions.md (reported line 32)May include surrounding context.

md

| `*` or an empty allowlist with auto-approve on | Everything; the rest of the list is decoration | Enumerate the ten commands actually used |
| `git *` | Hooks, `-c core.pager=<cmd>`, `-c alias.x=!<cmd>`, `--upload-pack=<cmd>` — all of which execute | `git status`, `git diff`, `git log`, each without arguments that start with `-c` |
| `npm *`, `pip *`, `brew *` | Package installs run lifecycle scripts from the network as the user | `npm ci` on a committed lockfile only, install steps proposed not auto-approved |
| `docker *` | `-v /:/host` plus `--privileged` is host root | Read-only subcommands; runs proposed |
| `curl *`, `wget *` | Fetch anything, write anywhere with `-o`, upload with `-d @file` | Named hosts, no `-o`, no `-d @` |
| `find *` | `-exec` and `-delete` | `find <path> -name <glob>` without `-exec`/`-delete` |
| `ssh *`, `rsync *` | Remote execution; `rsync -e '<cmd>'` runs locally | Named hosts, no `-e` |

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scheduled.md (reported line 11)May include surrounding context.

md

ies, systemd timers, launch agents, platform schedulers, webhook triggers, watch loops — record six fields in `## System Baseline` in `memory.md`: name, schedule, timezone, what it runs, where its output goes, and how you would know it failed. The sixth is the one that is usually empty, and it is the one that matters.

Jobs live in more places than anyone remembers: the user crontab, the system crontab and its drop-in directories, systemd timers, per-user launch agents, the agent platform's own scheduler, and CI schedules in repositories. A job inventory that covers one of those is why "it stopped running" investigations go in circles.

## Schedule Expression Bugs

| Expression | What people mean | What it does |
|---|---|---|
| `0 0 1 * 1` | First of the month, if it is a Monday | Runs on the 1st **and** every Monday — when both day-of-month and day-of-week are restricted, classic cron takes the **union**, not the intersection |
| `* * * * *` after an edit meant to be hourly | Hou

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 85)May include surrounding context.

md

| Working directory is not the project | Relative paths resolve elsewhere; files appear in `$HOME` | `cd` as the first action, absolute paths everywhere else |
| No TTY | Anything that prompts blocks forever | Non-interactive flags; treat a prompt as a bug |
| Different user | Permission denied on files the user owns; a different credential store | Run as the owning user, or make the credential reachable to the job's user (`secrets.md`) |
| No unlocked keychain on a locked machine | Auth failures only overnight | Move the credential to a store that survives lock, or reschedule |
| Locale and timezone differ | Dates parsed or formatted differently, off-by-one days | Set both explicitly in the job |

The diagnostic that settles it in one shot: run the job through the scheduler's own environment (an `env -i` invocation with only the variables the scheduler sets) rather than from your shell.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 153)May include surrounding context.

md

| Working directory is not the project | Relative paths resolve elsewhere; files appear in `$HOME` | `cd` as the first action, absolute paths everywhere else |
| No TTY | Anything that prompts blocks forever | Non-interactive flags; treat a prompt as a bug |
| Different user | Permission denied on files the user owns; a different credential store | Run as the owning user, or make the credential reachable to the job's user (`secrets.md`) |
| No unlocked keychain on a locked machine | Auth failures only overnight | Move the credential to a store that survives lock, or reschedule |
| Locale and timezone differ | Dates parsed or formatted differently, off-by-one days | Set both explicitly in the job |

The diagnostic that settles it in one shot: run the job through the scheduler's own environment (an `env -i` invocation with only the variables the scheduler sets) rather than from your shell.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 220)May include surrounding context.

md

| Working directory is not the project | Relative paths resolve elsewhere; files appear in `$HOME` | `cd` as the first action, absolute paths everywhere else |
| No TTY | Anything that prompts blocks forever | Non-interactive flags; treat a prompt as a bug |
| Different user | Permission denied on files the user owns; a different credential store | Run as the owning user, or make the credential reachable to the job's user (`secrets.md`) |
| No unlocked keychain on a locked machine | Auth failures only overnight | Move the credential to a store that survives lock, or reschedule |
| Locale and timezone differ | Dates parsed or formatted differently, off-by-one days | Set both explicitly in the job |

The diagnostic that settles it in one shot: run the job through the scheduler's own environment (an `env -i` invocation with only the variables the scheduler sets) rather than from your shell.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 223)May include surrounding context.

md

| Working directory is not the project | Relative paths resolve elsewhere; files appear in `$HOME` | `cd` as the first action, absolute paths everywhere else |
| No TTY | Anything that prompts blocks forever | Non-interactive flags; treat a prompt as a bug |
| Different user | Permission denied on files the user owns; a different credential store | Run as the owning user, or make the credential reachable to the job's user (`secrets.md`) |
| No unlocked keychain on a locked machine | Auth failures only overnight | Move the credential to a store that survives lock, or reschedule |
| Locale and timezone differ | Dates parsed or formatted differently, off-by-one days | Set both explicitly in the job |

The diagnostic that settles it in one shot: run the job through the scheduler's own environment (an `env -i` invocation with only the variables the scheduler sets) rather than from your shell.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scheduled.md (reported line 66)May include surrounding context.

md

| Working directory is not the project | Relative paths resolve elsewhere; files appear in `$HOME` | `cd` as the first action, absolute paths everywhere else |
| No TTY | Anything that prompts blocks forever | Non-interactive flags; treat a prompt as a bug |
| Different user | Permission denied on files the user owns; a different credential store | Run as the owning user, or make the credential reachable to the job's user (`secrets.md`) |
| No unlocked keychain on a locked machine | Auth failures only overnight | Move the credential to a store that survives lock, or reschedule |
| Locale and timezone differ | Dates parsed or formatted differently, off-by-one days | Set both explicitly in the job |

The diagnostic that settles it in one shot: run the job through the scheduler's own environment (an `env -i` invocation with only the variables the scheduler sets) rather than from your shell.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · skills.md (reported line 74)May include surrounding context.

md

## Local Edits

A modified installed skill is a real decision and a real hazard: the next update overwrites it without warning. Detect by comparing against the source copy where one exists; where it does not, an mtime later than the install date is the signal.

Action is not "revert". It is: record what was changed and why in `~/Clawic/data/analysis/artifacts/skill-edits.md` with its `## Boxes` line, so the edit can be reapplied after an update, and flag the skill as pinned so an update is a decision rather than a surprise.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: Analysis
slug: analysis
version: 1.0.2
description: Audits an AI agent's own setup — workspace, config, memory, skills, jobs, integrations — and reports what is broken, exposed, or wasteful. Use when asked to check the system, run a health check, or diagnose the setup, or when something feels off or the agent got slow or expensive; when a token, key, or .env may be exposed in a file, config, or git history; when permissions or auto-approve rules look too broad; when a scheduled job stops firing, runs twice, or fails silently; when sessions or subagents pile up or loop; when memory files bloat, go stale, contradict, or fall out of their index; when skills collide, never activate, or point at missing files; when an integration returns 401 or 429 or goes quiet; when token spend or context size jumps; and when the same finding keeps coming back. Not for vetting third-party skill code (`skill-audit`), workspace persona and proactivity tuning (`openclaw-workspace`), application monitoring (`monitoring`), or statistical analysis of a dataset.
homepage: https://clawic.com/skills/analysis
changelog: "Clearer disclosure of what is stored and where"
metadata:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

name: Analysis
slug: analysis
version: 1.0.2
description: Audits an AI agent's own setup — workspace, config, memory, skills, jobs, integrations — and reports what is broken, exposed, or wasteful. Use when asked to check the system, run a health check, or diagnose the setup, or when something feels off or the agent got slow or expensive; when a token, key, or .env may be exposed in a file, config, or git history; when permissions or auto-approve rules look too broad; when a scheduled job stops firing, runs twice, or fails silently; when sessions or subagents pile up or loop; when memory files bloat, go stale, contradict, or fall out of their index; when skills collide, never activate, or point at missing files; when an integration returns 401 or 429 or goes quiet; when token spend or context size jumps; and when the same finding keeps coming back. Not for vetting third-party skill code (`skill-audit`), workspace persona and proactivity tuning (`openclaw-workspace`), application monitoring (`monitoring`), or statistical analysis of a dataset.
homepage: https://clawic.com/skills/analysis
changelog: "Clearer disclosure of what is stored and where"
metadata:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

name: Analysis
slug: analysis
version: 1.0.2
description: Audits an AI agent's own setup — workspace, config, memory, skills, jobs, integrations — and reports what is broken, exposed, or wasteful. Use when asked to check the system, run a health check, or diagnose the setup, or when something feels off or the agent got slow or expensive; when a token, key, or .env may be exposed in a file, config, or git history; when permissions or auto-approve rules look too broad; when a scheduled job stops firing, runs twice, or fails silently; when sessions or subagents pile up or loop; when memory files bloat, go stale, contradict, or fall out of their index; when skills collide, never activate, or point at missing files; when an integration returns 401 or 429 or goes quiet; when token spend or context size jumps; and when the same finding keeps coming back. Not for vetting third-party skill code (`skill-audit`), workspace persona and proactivity tuning (`openclaw-workspace`), application monitoring (`monitoring`), or statistical analysis of a dataset.
homepage: https://clawic.com/skills/analysis
changelog: "Clearer disclosure of what is stored and where"
metadata:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · permissions.md (reported line 15)May include surrounding context.

md

name: Analysis
slug: analysis
version: 1.0.2
description: Audits an AI agent's own setup — workspace, config, memory, skills, jobs, integrations — and reports what is broken, exposed, or wasteful. Use when asked to check the system, run a health check, or diagnose the setup, or when something feels off or the agent got slow or expensive; when a token, key, or .env may be exposed in a file, config, or git history; when permissions or auto-approve rules look too broad; when a scheduled job stops firing, runs twice, or fails silently; when sessions or subagents pile up or loop; when memory files bloat, go stale, contradict, or fall out of their index; when skills collide, never activate, or point at missing files; when an integration returns 401 or 429 or goes quiet; when token spend or context size jumps; and when the same finding keeps coming back. Not for vetting third-party skill code (`skill-audit`), workspace persona and proactivity tuning (`openclaw-workspace`), application monitoring (`monitoring`), or statistical analysis of a dataset.
homepage: https://clawic.com/skills/analysis
changelog: "Clearer disclosure of what is stored and where"
metadata:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · permissions.md (reported line 29)May include surrounding context.

md

name: Analysis
slug: analysis
version: 1.0.2
description: Audits an AI agent's own setup — workspace, config, memory, skills, jobs, integrations — and reports what is broken, exposed, or wasteful. Use when asked to check the system, run a health check, or diagnose the setup, or when something feels off or the agent got slow or expensive; when a token, key, or .env may be exposed in a file, config, or git history; when permissions or auto-approve rules look too broad; when a scheduled job stops firing, runs twice, or fails silently; when sessions or subagents pile up or loop; when memory files bloat, go stale, contradict, or fall out of their index; when skills collide, never activate, or point at missing files; when an integration returns 401 or 429 or goes quiet; when token spend or context size jumps; and when the same finding keeps coming back. Not for vetting third-party skill code (`skill-audit`), workspace persona and proactivity tuning (`openclaw-workspace`), application monitoring (`monitoring`), or statistical analysis of a dataset.
homepage: https://clawic.com/skills/analysis
changelog: "Clearer disclosure of what is stored and where"
metadata:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · permissions.md (reported line 31)May include surrounding context.

md

name: Analysis
slug: analysis
version: 1.0.2
description: Audits an AI agent's own setup — workspace, config, memory, skills, jobs, integrations — and reports what is broken, exposed, or wasteful. Use when asked to check the system, run a health check, or diagnose the setup, or when something feels off or the agent got slow or expensive; when a token, key, or .env may be exposed in a file, config, or git history; when permissions or auto-approve rules look too broad; when a scheduled job stops firing, runs twice, or fails silently; when sessions or subagents pile up or loop; when memory files bloat, go stale, contradict, or fall out of their index; when skills collide, never activate, or point at missing files; when an integration returns 401 or 429 or goes quiet; when token spend or context size jumps; and when the same finding keeps coming back. Not for vetting third-party skill code (`skill-audit`), workspace persona and proactivity tuning (`openclaw-workspace`), application monitoring (`monitoring`), or statistical analysis of a dataset.
homepage: https://clawic.com/skills/analysis
changelog: "Clearer disclosure of what is stored and where"
metadata: