Security audit
Security checks across malware telemetry and agentic risk
This is a local approval-management tool, but its persistent category-based auto-approval can let future agent requests skip human review too broadly.
Install only if approval commands are controlled by a trusted user or trusted wrapper. Do not let the agents being governed run approve or approve --learn themselves. Use learned categories only for narrow, low-risk actions, review categories and pending/history files regularly, and reset approvals after mistakes or suspicious behavior.
--- name: local-approvals description: Local approval system for managing agent permissions. Use CLI to approve/deny requests, view history, and manage auto-approved categories. --- # Local Approvals Skill
# Local Approvals Skill A local approval system that manages agent permissions with auto-approve lists and approval history tracking. ## Quick Start
The skill maintains two JSON files in the state directory: - **state.json**: Auto-approve lists and approval history - **pending.json**: Pending approval requests Location: `~/.openclaw/skills/local-approvals/`
The `core.py` module provides the underlying functionality: - `check_auto_approve(agent, category)` - Check if a category is auto-approved - `submit_request(agent, category, operation, reasoning)` - Submit a pending request - `learn_category(agent, category)` - Add category to auto-approve list - `get_request(request_id)` - Retrieve a request by ID
The `core.py` module provides the underlying functionality: - `check_auto_approve(agent, category)` - Check if a category is auto-approved - `submit_request(agent, category, operation, reasoning)` - Submit a pending request - `learn_category(agent, category)` - Add category to auto-approve list - `get_request(request_id)` - Retrieve a request by ID
- `check_auto_approve(agent, category)` - Check if a category is auto-approved - `submit_request(agent, category, operation, reasoning)` - Submit a pending request - `learn_category(agent, category)` - Add category to auto-approve list - `get_request(request_id)` - Retrieve a request by ID - `update_request(request_id, decision, reviewer)` - Update request with decision - `list_pending(agent)` - List pending requests
- `get_request(request_id)` - Retrieve a request by ID - `update_request(request_id, decision, reviewer)` - Update request with decision - `list_pending(agent)` - List pending requests - `get_agent_approvals(agent)` - Get agent's auto-approved categories ## Best Practices
## Best Practices 1. **Review before approving**: Always check the operation and reasoning before approving 2. **Use auto-learn carefully**: Only use `--learn` for trusted categories that you want to auto-approve 3. **Check history regularly**: Review `history` to understand approval patterns 4. **Reset when needed**: Use `reset` to clear an agent's auto-approve list if you suspect issues
1. **Review before approving**: Always check the operation and reasoning before approving 2. **Use auto-learn carefully**: Only use `--learn` for trusted categories that you want to auto-approve 3. **Check history regularly**: Review `history` to understand approval patterns 4. **Reset when needed**: Use `reset` to clear an agent's auto-approve list if you suspect issues ## Examples
# Auto-learn the category if requested
if auto_learn:
learn_category(updated['agent'], updated['category'])
print(f" 📚 Category '{updated['category']}' added to auto-approve for agent '{updated['agent']}'")
return Truestate = _load_state()
# Get the auto-approve list for this agent
agent_approvals = state.get("auto_approve", {}).get(agent, [])
# Check if category is in the list
return category in agent_approvalsstate["auto_approve"][agent] = []
# Add category if not already present
if category not in state["auto_approve"][agent]:
state["auto_approve"][agent].append(category)
_save_state(state)
return True64/64 vendors flagged this skill as clean.
No suspicious patterns detected.