Security audit
Security checks across malware telemetry and agentic risk
This appears to be a real OpenClaw health monitor, but it creates recurring execution, sends local security summaries to Feishu, and applies a local permission change without separate approval steps.
Install only if you are comfortable with a recurring weekday local scan that reads OpenClaw workspace state, stores local history, sends summaries to a bound Feishu open_id, runs Node build tooling, and automatically chmods the Gateway LaunchAgent plist. Use least-privileged Feishu credentials, avoid putting those credentials in workspace .env, and confirm how to disable the cron job and automatic GREEN fixes before enabling it.
sys.exit(1)
print("Frontend deps missing, running npm install...")
result = subprocess.run(
[npm_bin, "install"],
cwd=FRONTEND_DIR,
capture_output=True,if not npm_bin:
print("npm is required to build the dashboard frontend.", file=sys.stderr)
sys.exit(1)
result = subprocess.run(
[npm_bin, "exec", "--", "vite", "build"],
cwd=FRONTEND_DIR,
capture_output=True,def load_env_fallback(var_names: list[str]) -> dict[str, str]:
"""Load selected vars from workspace .env when current process env is missing them."""
env_path = Path(get_workspace_root()) / ".env"
if not env_path.exists():
return {}def load_env_fallback(var_names: list[str]) -> dict[str, str]:
"""Load selected vars from workspace .env when current process env is missing them."""
env_path = Path(get_workspace_root()) / ".env"
if not env_path.exists():
return {}66/66 vendors flagged this skill as clean.
No suspicious patterns detected.