Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed workflow for reviewing and versioning a specific HTML game, with some operational caution around broad triggers and Feishu sending.
Before installing, make sure you are comfortable with the skill reading peace*.html files from the OpenClaw workspace, creating new versioned HTML files, and sending a Feishu notification. Use explicit invocation wording and review outputs before sharing them externally.
The skill metadata and examples advertise broad trigger phrases such as “peace迭代”, “和平评审”, and “游戏优化”, which are generic enough to match ordinary conversation rather than an explicit request to invoke this skill. That increases the chance of unintended activation, causing the agent to read workspace files and start a file-modifying workflow without sufficiently deliberate user intent.
The skill explicitly describes creating a new HTML version and sending it to the user via Feishu, but it does not require prior user confirmation, warn about file modification, or constrain outbound delivery. In context, this is more dangerous because the workflow reads local workspace files, mutates artifacts, and performs external transmission, creating risks of unauthorized changes, unintended data disclosure, and accidental exfiltration.
No suspicious patterns detected.
