Security audit
Security checks for vulnerabilities and agentic risk
This skill asks agents to do broad destructive cleanup and context resets under vague or automatic triggers, while the packaged script only performs status checks and writes a state file.
Review this skill carefully before installing. It is intended for destructive cleanup and context reset, so use it only if you are comfortable with broad workspace access, retained snapshots/logs, and ambiguous automatic triggers. Require explicit confirmation and inspect any actual cleanup script before allowing deletion actions.
声明描述的核心能力是“彻底删除不需要的东西，释放空间”，意味着应实际执行清理/删除。但代码的主功能是检测是否需要清理：统计临时文件、旧日志、memory 目录大小和回收站文件数，计算一个分数，输出“清理报告”和“清理建议”，并保存检查状态到 state.json。代码中没有任何 rm、删除、压缩或清空操作，因此其主要行为与声明的主要目的存在实质性不一致。
The trigger set is extremely broad, covering common user phrases like '清理', '删除', '重置', and '清空', plus automatic activation around token thresholds and damaged-context conditions. In a destructive skill, broad triggers materially raise the chance of unintended invocation, which could lead to data loss or unsafe cleanup actions without sufficiently specific user intent.
The natural-language content, trigger phrases, confirmations, and output format are entirely specified in Chinese, implying a fixed language/locale behavior. The file does not offer a user opt-in or alternative language handling, and it does not document that the skill is intentionally limited to a Chinese-only environment.
The condition '上下文严重损坏时' is subjective and undefined, allowing the skill to self-justify activation when the system is confused or degraded. Ambiguous activation criteria are especially risky for a destructive reset/delete workflow because they can bypass normal deliberation and lead to accidental erasure under uncertain conditions.
The snapshot mechanism explicitly stores '当前所有上下文的关键摘要' before destructive resets, which creates a retained copy of potentially sensitive user/context data. Even when framed as rollback protection, durable snapshotting of context increases privacy and data-retention risk, especially if stored in predictable filesystem locations without access controls or minimization.
The mandatory cleanup log records preserved content, trigger reasons, snapshot filenames, and operator details, creating a durable plain-language record of user/context state. For a skill centered on deletion and reset, this undermines data minimization and can expose sensitive operational history or user data long after the cleanup event.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| scripts/autophagy/autophagy.sh | 清理脚本（small/medium/large/status） |
| .autophagy/cleanup-log.md | 清理日志 |
| .autophagy/snapshots/ | 快照目录（7天后自动清理） |
| skills/apollo-autophagy/SKILL.md | 本文档 |
## v1 实施规格
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
WORKSPACE="/root/.openclaw/workspace"
AUTOPHAGY_STATE="/root/.openclaw/workspace/.autophagy/state.json"
mkdir -p "$(dirname "$AUTOPHAGY_STATE")"
# 检查临时文件
check_temp_files() {
No suspicious patterns detected.