Security checks across malware telemetry and agentic risk
This skill is not clearly malicious, but it deserves review because it can automatically post public TikTok comments from a logged-in Android device and may send screenshots to AI providers.
Install only if you are comfortable letting OpenClaw control an Android device and post publicly as the logged-in TikTok account. Use a dedicated account/device, start with very small limits, avoid cron until you have monitoring and an easy disable path, and use static comments instead of AI mode if you do not want screenshots sent to external providers.
Command output
"""
try:
result = subprocess.run(
["adb", "-s", self.device_id, "shell", command],
capture_output=True,
text=True,response = input("Run interactive setup now? [Y/n]: ").strip().lower()
if response in ['', 'y', 'yes']:
print("\nStarting setup wizard...\n")
os.system("python3 setup.py")
if not os.path.exists("config.py"):
print("\n❌ Setup was not completed. Exiting.")
sys.exit(1)64/64 vendors flagged this skill as clean.