Back to skill
Skillv1.0.0
ClawScan security
Agent Heartbeat · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 2, 2026, 9:34 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- Instruction-only skill that provides guidance for configuring an agent heartbeat; its requirements and behavior are consistent with its stated purpose, with one minor note about an undeclared CLI dependency.
- Guidance
- This is an instruction-only skill that helps you author a HEARTBEAT.md and follow best practices for periodic agent tasks. Before using it: (1) ensure you have the OpenClaw CLI available if you plan to run the shown commands (the SKILL.md references it but the skill metadata doesn't declare the binary), (2) place HEARTBEAT.md in a repository or path your agent legitimately uses and set file permissions appropriately, (3) keep heartbeat tasks lightweight and avoid doing sensitive operations in them, and (4) test heartbeats in a staging environment to confirm they don't unintentionally trigger heavy work or data exposure. Because the skill contains only documentation and examples, it does not itself execute code or request credentials.
Review Dimensions
- Purpose & Capability
- noteThe skill's name and description (configuring an agent heartbeat) match the SKILL.md contents (creating HEARTBEAT.md, examples, best practices). One small inconsistency: the documentation references the 'openclaw' CLI, but the registry metadata lists no required binaries. The skill is instruction-only and does not itself install or require additional services, but users should have the OpenClaw CLI available for the provided commands to work.
- Instruction Scope
- okSKILL.md stays within scope: it describes creating a HEARTBEAT.md, how to configure/check heartbeat, best practices, and a small JavaScript example. It does not instruct reading unrelated system files, collecting secrets, or sending data to external endpoints beyond expected notifications (e.g., notifyAdmin in example).
- Install Mechanism
- okNo install spec and no code files — lowest-risk, nothing is written to disk by the skill itself. The skill only provides guidance and examples.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths, and the instructions do not request secrets or unrelated credentials. Proportional to its stated purpose.
- Persistence & Privilege
- okalways is false and the skill is user-invocable; it does not request permanent presence or modify other skills' configs. Autonomous model invocation remains platform-default and is not specially enabled here.