Scripts Backup
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The package nominally implements a metals-price monitor, but it also contains scripts that modify OpenClaw/agent workspaces and session files (hardcoded to /Users/claw), which is outside the stated purpose and raises safety concerns.
This package includes a plausible price-monitor (FastAPI, scrapers, SQLite) but also several maintenance scripts that modify OpenClaw agent workspaces and session files using hardcoded paths (e.g., /Users/claw/.openclaw, /Users/claw/.qclaw). Before installing or running it: 1) Inspect cleanup_sessions.py and fix-agent-config.sh carefully — they delete or overwrite session and workspace files and will run on the host filesystem. 2) Don’t run these scripts as-is on a production or multi-user machine; test in an isolated container or VM. 3) Verify and adapt configuration key names (SKILL.md's config layout vs cleanup_sessions.py expectations) to avoid leaking tokens. 4) If you only want price-monitoring, remove or sandbox the maintenance scripts and avoid running the shell fix scripts. 5) Back up ~/.openclaw and ~/.qclaw data before running, and avoid running as root. If you want, I can list all files that perform filesystem writes/deletes and point to the exact lines that modify other agents' directories.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.