Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed, local guidance package for creating safer OpenClaw heartbeat files, with only minor configuration caveats.
Before installing, expect the agent to create or update local files under ~/heartbeat/ for heartbeat preferences, drafts, and snapshots. Replace the example Europe/Madrid timezone with your own, and review any proposed cron handoff before allowing scheduled jobs.
The template specifies timezone: Europe/Madrid, which imposes a locale-specific setting in natural language/config content. The file does not indicate that this is optional, user-selected, or justified as region-specific, so it can violate the policy against forcing a locale without opt-in.
The template sets timezone: Europe/Madrid as the default value, which imposes a specific locale in natural-language configuration guidance. The policy requires avoiding forced language or locale choices unless the constraint is justified or the user is given an explicit choice.
The setup instructs the agent to persist the user's chosen operating mode in ~/heartbeat/memory.md without explicitly informing the user that local data will be written. While the stored data appears low sensitivity, undisclosed persistence can create privacy and consent issues, especially if users do not expect configuration state to be retained across sessions.
No suspicious patterns detected.
