Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Wake-on-LAN helper that sends local network wake packets and stores a disclosed device list.
Install only if you want an agent to send Wake-on-LAN packets on your local network and maintain a saved device list under ~/.config/openclaw/wol-devices.json. Review saved devices before using broadcast, and prefer explicit Wake-on-LAN phrasing to avoid ambiguous commands.
The skill describes shell-capable behavior via installation and command execution patterns but does not declare any tool scope such as allowed-tools or permissions. This weakens enforcement and review because an agent may invoke shell actions without an explicit least-privilege contract, increasing the chance of unintended command execution.
The trigger phrase "wake" is extremely generic and can match ordinary user intent unrelated to Wake-on-LAN, causing accidental invocation of this skill. Unintended activation matters here because the skill can send network packets and modify persistent device configuration, so a simple conversational phrase could trigger side effects.
The documented commands are highly generic (for example, list, add, remove, status, broadcast) and lack namespace or scope constraints, making them prone to collision with unrelated skills or normal assistant actions. Because these commands can alter saved configuration and send network-wide wake traffic, ambiguous routing could produce unintended state changes or network actions.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
brew install wakeonlan
The manifest describes Wake-on-LAN functionality for waking devices by MAC address or name, which reasonably covers sending WoL packets and looking up names. However, the script also adds/removes/list devices in a persistent config file and performs status checks with ping, which extends beyond the stated wake-only behavior into local device management and network reachability monitoring.
This markdown file states that the skill will automatically manage a device configuration file and later exposes add/remove and broadcast operations, but it does not include an explicit warning that the skill writes to a local config file and can send Wake-on-LAN packets to all saved devices on the local network. For a user-facing skill description, those behaviors can affect local data and networked systems and should be disclosed clearly.
A Wake-on-LAN skill is expected to send magic packets to wake hosts, but actively probing devices with ping is a separate network-scanning/status capability. Because the manifest only mentions waking devices remotely by MAC address or name, the status-check behavior is not explicitly within the declared purpose.
No suspicious patterns detected.