Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed OzBargain deal monitor that creates scheduled OpenClaw jobs and sends results to user-chosen destinations.
Before installing, confirm that you want OpenClaw to create recurring cron jobs, send deal summaries to the configured chat or group, and keep a local dedupe file of sent OzBargain links. For troubleshooting, confirm the destination before allowing any live probe message.
The troubleshooting instructions tell the agent to send a probe message directly to the configured destination without requiring an explicit user warning or approval. This can cause unintended outbound communication to real chats or groups, potentially leaking operational details, creating spam, or messaging the wrong recipient if the destination is stale or misconfigured.
The template explicitly sets 输出语言：<LANGUAGE>, which hard-codes the response language through configuration rather than offering the end user a language or locale choice. The policy for this audit flags language or locale constraints unless they are optional or clearly justified as region-specific.
The skill instructs the agent to create and update a user-specific local state file for deduplication, but it does not require any explicit user notice or confirmation before modifying local data. While the write target is narrowly scoped and operationally relevant, silent filesystem modification can violate user expectations and creates a persistence side effect that may matter in shared or sensitive environments.
No suspicious patterns detected.
