WOL

ReviewAudited by ClawScan on May 10, 2026.

Overview

This looks like a legitimate Wake-on-LAN skill, but its script can print full MAC addresses even though the skill says MAC addresses should stay hidden.

Install only if you are comfortable with a local WOL tool that stores device MAC/IP details and can wake machines on your LAN. Ask the maintainer to fix or confirm MAC-address masking before relying on its privacy claims.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

A requested command may wake a configured or addressable computer on the local network.

Why it was flagged

The skill instructs the agent to run a local script that sends Wake-on-LAN packets. This is expected for the stated purpose, but it is still a real device-control action on the user's local network.

Skill content

python3 ~/.openclaw/workspace/skills/wol/scripts/wol.py --target <target>

Recommendation

Only use this skill for devices you own or are authorized to wake, and review configured device names before invoking wake commands.

Concern

ASI09: Human-Agent Trust Exploitation

What this means

Full MAC addresses may appear in tool output and could be exposed if the agent summarizes or relays command results.

Why it was flagged

These outputs include full MAC addresses. That conflicts with SKILL.md's security guidance that says full MAC addresses should not be revealed through conversation.

Skill content

print(f"Found {target} in devices as '{name}': {mac}") ... print(f"✓ Magic packet sent to {mac_address}") ... print(f"✓ Device '{name}' added: MAC={mac}, IP={ip}, Subnet={subnet_mask}")

Recommendation

Update the script to mask MAC addresses in all printed output, not just list/show commands, or require the agent to suppress raw command output when it contains MAC addresses.

Note

ASI06: Memory and Context Poisoning

What this means

Saved device names, IP addresses, subnet masks, and MAC addresses remain in the skill's configuration file for later tasks.

Why it was flagged

The skill keeps a persistent local device registry containing network identifiers. This is purpose-aligned for WOL, but users should know the data persists across future uses.

Skill content

Devices are stored in `references/devices.yaml`

Recommendation

Keep the device list limited to needed devices and remove entries when they are no longer required.