Security audit
Security checks for vulnerabilities and agentic risk
This is a simple greeting skill that prints a name-based greeting and does not show hidden data access, persistence, or destructive behavior.
Install only if you are comfortable with a demo skill that may be invoked for greeting requests and that advertises a GitHub release update endpoint. Review the publisher/source if provenance matters, especially because the manifest and script header list different author names.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"license": "MIT",
"min_openclaw_version": "1.0.0",
"entry_point": "scripts/greet.py",
"update_url": "https://api.github.com/repos/liuzewei1990/openclaw-skill-demo/releases/latest",
"tags": ["demo", "greeting", "utility"],
"requirements": {
"python": ">=3.8"
The markdown says the skill can be invoked 'when users ask for greetings' and gives 'Say hello to Alice' as an example, but it does not define the exact trigger scope or any exclusion conditions. This is broad everyday language that could overlap with common chat requests and cause unintended invocations.
This manifest describes the skill only as 'A simple greeting skill for OpenClaw' without any explicit trigger phrases, activation conditions, or exclusions. For manifest files, the absence of specific invocation scope can make it unclear when the skill should activate versus when it should not.