Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only skill for reviewing OpenClaw skill files, with no evidence of hidden execution, persistence, credential access, or data exfiltration.
Before installing, users should know this skill is meant for auditing OpenClaw SKILL.md files and may read a skill file path they provide. Authors may want to adjust the EN/CN trigger-language guidance for their own audience, but no dangerous behavior was found.
The trigger description is overly broad because it includes generic phrases like 'or similar requests', which can cause the skill to activate for loosely related prompts. In a review/audit skill, unintended invocation can misroute user requests, override a more appropriate skill, or expose file-review behavior in contexts where it was not intended.
The example description explicitly requires trigger phrases in EN/CN, and later sections repeat that descriptions should include English and Chinese colloquial triggers. This imposes a language expectation in the skill standard without user opt-in or a documented region-specific justification, which matches the locale-policy violation criteria.
The metadata template states that the description should contain trigger phrases in EN/CN. Because this is a normative requirement in natural-language guidance and does not provide user choice or a justified regional constraint, it is a policy violation under the language/locale rule.
The remediation guide tells authors to list trigger phrases in EN and CN, reinforcing a specific language policy. This is a natural-language instruction that forces a locale choice without opt-in or stated justification.
The checklist item says descriptions should include EN/CN triggers. As a prescriptive standard, this mandates particular languages rather than allowing user preference or a documented locale-specific exception.
No suspicious patterns detected.
