Security audit
Security checks across malware telemetry and agentic risk
This live-streaming skill is not clearly malicious, but it makes broad persistent platform changes and exposes sensitive live-control functions that need review before installation.
Install only on an isolated host or test workspace unless you are comfortable with public live streaming, shared OpenClaw configuration changes, persistent daemons, and bundled skills being added. Use dedicated least-privilege Tencent Cloud keys, put the viewer and gateway behind firewall/auth controls, review the email/music sub-skills, and confirm a working stop/uninstall process before exposing it to the internet.
install_cmd = ["sudo", "-n", manager_cmd, "install", "-y", pkg]
try:
result = subprocess.run(
install_cmd, capture_output=True, text=True, timeout=120
)
if result.returncode == 0:# 4. 设置 gateway 监听公网
try:
subprocess.run(
["openclaw", "config", "set", "gateway.bind", "lan"],
capture_output=True, text=True, timeout=10
)print(f" [!] Missing Python dependencies: {', '.join(_missing_deps)}")
print(f" [*] Auto-installing: pip install {' '.join(_missing_deps)}")
try:
result = subprocess.run(
[sys.executable, "-m", "pip", "install", "--quiet"] + _missing_deps,
capture_output=True, text=True, timeout=120
)66/66 vendors flagged this skill as clean.
Detected: suspicious.insecure_tls_verification