Security audit
Security checks for vulnerabilities and agentic risk
This skill only checks OpenClaw version information, reads public release notes, and sends update advice without performing updates itself.
Install this only if you want periodic OpenClaw update checks and are comfortable with the skill sending version and release-summary information through Feishu or the configured messaging tool. Configure any daily cron job yourself and keep it limited to reporting, not automatic updating.
The skill specifies pushing update recommendations through Feishu but does not warn users that version information, release summaries, and potentially environment-specific context may be transmitted to an external messaging platform. This creates a privacy and data-handling risk because users may not realize operational metadata is being shared outside the local environment.
The manual trigger phrase is described as "用户发送'检查更新'或类似指令时执行", which is broad enough to allow accidental or unintended activation from loosely related user messages. In a skill that executes local commands and fetches remote content, ambiguous triggering increases the chance of unauthorized or surprising actions, even if the skill only checks status and sends recommendations rather than performing updates.
All user-facing instructions and example output are specified only in Chinese, with no indication that the skill can adapt to the user's preferred language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
No suspicious patterns detected.
