Security audit
Security checks across malware telemetry and agentic risk
The skill mostly matches its stated purpose, but some personality commands are not safely confined to the personalities folder and could delete or alter broader OpenClaw workspace files with crafted names.
Review before installing. Only use this skill if you accept persistent changes to assistant identity files and Telegram-accessible personality commands. A safer version should validate delete, rename, and switch names before resolving paths and should refuse names like dot-dot or paths containing slashes; until then, avoid installing it in workspaces where accidental or remote command input could damage important OpenClaw files.
BACKUPS_DIR="${PERSONALITIES_DIR}/backups"
HEARTBEAT_FILE="${WORKSPACE}/HEARTBEAT.md"
# Create personalities and backups directories
mkdir -p "$PERSONALITIES_DIR"
mkdir -p "$BACKUPS_DIR"64/64 vendors flagged this skill as clean.
No suspicious patterns detected.