Security audit
Security checks across malware telemetry and agentic risk
This earnings-report skill mostly matches its stated purpose, but it ships hardcoded API keys and a fixed Telegram recipient, so users should review and fix it before installing.
Do not install this as-is unless you first remove the bundled API keys, replace all destination IDs with your own configuration, verify the Telegram target, and inspect the referenced Obsidian Scout script. Use environment variables or a secret manager for credentials, rotate any exposed keys, and run it in a limited environment until you confirm the Notion, Obsidian, Telegram, and package-install behavior is exactly what you want.
}
def run_command(cmd):
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=120)
return result.stdout, result.stderr
def invoke_scout(command, params=None):import shlex
safe_content = shlex.quote(report)
cmd = f'/usr/bin/python3 /root/.openclaw/skills/obsidian-scout/scripts/librarian.py STOCK "{title}" {safe_content}'
subprocess.run(cmd, shell=True)
return {"status": "ok"}No VirusTotal findings
No suspicious patterns detected.