Agent Health Monitor
WarnAudited by ClawScan on May 18, 2026.
Overview
The skill mostly performs local health checks, but it also runs a hard-coded script from another skill directory that is not disclosed in its description.
Review the code before installing. The normal health-check behavior is local and mostly purpose-aligned, but the hard-coded execution of a Feishu wrapper lifecycle script is outside the advertised scope and should be removed or explicitly trusted before use.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the skill may execute local commands and inspect local OpenClaw session metadata and system resource status.
The skill invokes local shell commands to gather health information. This is broadly aligned with monitoring, but users should know it relies on local command execution.
execSync('openclaw sessions list --json 2>/dev/null || echo "[]"', { ... });Use it only in an environment where local command execution for health checks is acceptable, and prefer safer command APIs with fixed arguments where possible.
If that external skill directory exists or is modified, this monitor can run code outside the reviewed package under the user's permissions.
Each health check can execute a lifecycle.js file from a hard-coded external skill directory that is not included in the manifest and is not disclosed by the generic health-monitor description.
const wrapperPath = path.join(process.env.HOME, '.openclaw', 'workspace', 'skills', 'feishu-evolver-wrapper');
const output = execSync(`cd ${wrapperPath} && node lifecycle.js status 2>/dev/null || echo "unknown"`, { ... });Remove the hard-coded external skill execution, or make it an explicitly documented, optional, user-configured integration. Use a reviewed API or execFile/spawn with a fixed cwd and arguments instead of shelling into another skill.