Security audit
Security checks for vulnerabilities and agentic risk
This skill is a workspace-configuration helper that reads expected OpenClaw files and keeps changes user-reviewed rather than performing hidden or automatic system actions.
Before installing, be aware that this skill is meant to inspect and help rewrite OpenClaw workspace configuration files, which may contain personal preferences, memory, or agent behavior rules. Review any generated changes carefully before applying them, especially changes to SOUL.md, AGENTS.md, MEMORY.md, or USER.md.
The skill claims it only works in a sandbox and does not modify originals, but the finding indicates implementation accesses the real workspace directly and does not actually implement the promised create/optimize safeguards. This kind of description-behavior mismatch can mislead users into granting trust under false assumptions, enabling unintended access to sensitive workspace files or unsafe modification paths.
The suggested triggers are very broad natural-language requests such as 'Analyze my workspace configuration' and 'Optimize my workspace files', which creates weak activation boundaries. In systems that auto-route skills based on user phrasing, this can cause accidental invocation on ordinary requests, increasing the chance that the skill analyzes sensitive workspace content or influences agent behavior unexpectedly.
Without declared permissions the skill's intent is opaque and cannot be validated.
The listed triggers include generic phrases like "analisar workspace", "otimizar arquivos", and "verificar se arquivos estão corretos", which are common requests that could match many unrelated contexts. The description does not provide exclusion conditions or tighter scope boundaries to distinguish OpenClaw workspace-architecture tasks from everyday file-help requests.
The inline documentation repeatedly states that all work is done in a sandbox area, yet the implementation accesses the live home-directory workspace. In an agent skill context, misleading safety claims are especially risky because they can cause operators to approve execution under false assumptions about data isolation.
The skill advertises that all work occurs in a sandbox without touching originals, but the analyze command reads directly from ~/.openclaw/workspace in the user's home directory. This mismatch can expose real workspace contents to analysis flows or downstream consumers that users reasonably believed were isolated, creating a confidentiality and trust-boundary issue.
This markdown file contains normative instruction text in Portuguese within an otherwise English specification, and similar Portuguese-only directives recur throughout the document. Because the file defines required structure and guidance for agent workspace files, this effectively imposes a language/locale choice without user opt-in or a documented region-specific justification.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Pattern | Wrong Location | Right Location |
|---------|---------|---------|
| "Never do X without approval" | IDENTITY.md, USER.md | SOUL.md |
| "I am friendly and helpful" | SOUL.md, USER.md | IDENTITY.md |
| "User prefers X format" | SOUL.md, IDENTITY.md, MEMORY.md | USER.md |
| "The server is at 192.168.x.x" | SOUL.md, IDENTITY.md | MEMORY.md |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Pattern | Wrong Location | Right Location |
|---------|---------|---------|
| "Never do X without approval" | IDENTITY.md, USER.md | SOUL.md |
| "I am friendly and helpful" | SOUL.md, USER.md | IDENTITY.md |
| "User prefers X format" | SOUL.md, IDENTITY.md, MEMORY.md | USER.md |
| "The server is at 192.168.x.x" | SOUL.md, IDENTITY.md | MEMORY.md |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Pattern | Wrong Location | Right Location |
|---------|---------|---------|
| "Never do X without approval" | IDENTITY.md, USER.md | SOUL.md |
| "I am friendly and helpful" | SOUL.md, USER.md | IDENTITY.md |
| "User prefers X format" | SOUL.md, IDENTITY.md, MEMORY.md | USER.md |
| "The server is at 192.168.x.x" | SOUL.md, IDENTITY.md | MEMORY.md |
The file contains an unqualified Portuguese-language directive ('Princípio: Clareza Primeiro' and related prose) inside prescriptive guidance. In a skill that shapes workspace content and best-practice recommendations, forcing or privileging a non-user-requested language can alter downstream agent behavior, reduce accessibility, and create instruction ambiguity for users expecting English-only guidance.
This markdown file includes example prompts entirely in Portuguese, which can steer downstream skill creation toward a specific language/locale by default. The policy allows locale-specific behavior only when it is user-selected or clearly justified, but this section does not present Portuguese as an opt-in choice.
The questionnaire's tone section uses Portuguese address forms such as "você" and "tu" as the assumed framing for agent behavior. That creates a natural-language locale preference that is not clearly optional or justified, which conflicts with the requirement not to force a language or locale without user choice.
Line L35 states a principle in Portuguese ('Princípio: Resuma o máximo possível...') within the skill instructions, which can imply a language or locale preference not offered as an opt-in choice. Under the policy rule, forcing or embedding a specific language without user choice can be a natural-language policy concern.
The user-facing instructions, examples, and output guidance are presented in Portuguese, which effectively imposes a language preference. There is no indication that the skill supports alternative languages or that Portuguese is a required, justified locale for this skill.
The USER.md template requires a 'Language: [preferred language]' field, but the surrounding specification does not clarify that this is user-selected and optional rather than a fixed operating language. In a policy audit, locale-related defaults should be clearly framed as user preference or opt-in to avoid implicit language enforcement.
This markdown file includes trigger phrases only in Portuguese for the example multi-mode skill, mapping commands like "criar novo agente" and "analisar workspace" to modes. Because the document does not explain that the example is intentionally locale-specific or offer alternative language phrasing, it presents a language-specific invocation pattern that could conflict with a language/locale neutrality policy.
No suspicious patterns detected.