Security audit
Security checks across malware telemetry and agentic risk
This looks like a legitimate OKKI Go prospecting and outreach skill, but it needs review because it can run installers, create optional scheduled update reminders, and store sensitive contact/outreach data locally by default.
Review before installing if you are not comfortable with an agent running an npm installer, saving API keys locally, creating an optional scheduled update reminder, or retaining raw prospect/contact/email data on disk. Use platform secret storage where possible, decline update notifications unless needed, confirm every paid unlock or email send, and periodically delete local OKKI Go temp/artifact files that contain contacts or message content.
Use this flow when a user asks to install, set up, add, update, or enable OKKI Go. Do not rely on the npm package's interactive prompt. Ask the install questions in chat, map the answers to installer flags, then execute the installer yourself when the host provides shell/tool execution. Do not just display the command. Do not ask the user to choose a language. Use the user's current conversation language for all prompts and explanations. One-step execution path: when the user already named a runtime and install location, or a preinstalled agent knows its own known runtime and the default global location is appropriate, skip the wizard questions and execute the flagged installer directly.
Primary persistent storage:
- Credential cache: `${XDG_CONFIG_HOME:-$HOME/.config}/okki-go/credentials.json`, mode `0600`.
- Registered source: `${XDG_CONFIG_HOME:-$HOME/.config}/okki-go/auth-source.json`, mode `0600`, non-secret source metadata only.
Resolution order:exit 0
fi
# Create cron job
PAYLOAD='CURRENT=$(cat ~/.openclaw/workspace/skills/okki-go/VERSION 2>/dev/null); if [ -z "$CURRENT" ]; then CURRENT=$(grep "^version:" ~/.openclaw/workspace/skills/okki-go/SKILL.md 2>/dev/null | awk '\''{print $2}'\''); fi; if [ -z "$CURRENT" ]; then CURRENT="unknown"; fi; LATEST=$(clawhub search okki go --limit 1 2>/dev/null | jq -r '\''if .[0] then .[0].version else "unknown" end'\''); if [ -n "$LATEST" ] && [ "$CURRENT" != "$LATEST" ] && [ "$LATEST" != "unknown" ]; then CHANGELOG=$(clawhub show okki-go@$LATEST --changelog 2>/dev/null | head -15); echo "📦 OKKI Go new version available"; echo ""; echo "Current version: $CURRENT"; echo "Latest version: $LATEST"; echo ""; echo "What'\''s new:"; echo "$CHANGELOG"; echo ""; echo "Update command: openclaw skills update okki-go"; echo "Skip: dismiss this notification, remind again next week"; elif [ "$CURRENT" = "$LATEST" ]; then echo "✅ OKKI Go is already up to date ($CURRENT)"; fi'
echo ""VirusTotal findings are pending for this skill version.
Detected: suspicious.dangerous_exec