Task Auditor

独立第三方审计auto-iterator任务质量，按执行日志、迭代次数、报告质量等指标评分防止偷懒并自动警报。

Security Scan

The skill's code generally matches an auditing purpose, but there are multiple internal inconsistencies (undeclared filesystem assumptions, mismatched thresholds, and undocumented write locations) that deserve review before installation.

Purpose & Capability

The skill claims to be an independent task auditor and includes a shell script that performs log/report checks — that matches the stated purpose. However the runtime script hardcodes filesystem paths under /root/.openclaw/workspace (TASKS_DIR and MEMORY_DIR) while the skill metadata declares no required config paths or environment. The script writes audit and alert files into those locations; that filesystem access was not declared in the registry metadata and may require elevated permissions or an expected workspace layout.

Instruction Scope

SKILL.md describes reasonable audit checks and the included audit.sh implements them (log lines, iterations, report size, keywords, timestamps). It does not call external endpoints or exfiltrate data. Minor scope issues: SKILL.md claims '时间戳不可伪造' (timestamps cannot be forged) but the script performs only simple grep checks and does not implement tamper-proofing; SKILL.md and script disagree about the passing thresholds (SKILL.md/skill.json treat ≥80 as excellent, but audit.sh treats ≥90 as the cutoff for 'excellent' and considers <90 a failure).

Install Mechanism

There is no install spec (instruction-only), which is lower risk. However the package includes executable code (audit.sh) that will be run — so although nothing is downloaded at install time, the skill will perform filesystem writes when executed. That distinction is important: no install-time network risk, but runtime writes occur.

Credentials

The skill declares no required credentials or environment variables, and the script does not read secrets. Still, it assumes specific writable directories under /root/.openclaw/workspace/tasks and /root/.openclaw/workspace/memory. Requiring write access to /root paths is disproportionate for many environments and should be documented or made configurable. No explicit justification for using root-level paths is provided.

Persistence & Privilege

The skill is not marked always:true and does not request autonomous elevation. It writes its own audit and alert files in the workspace but does not modify other skills or system-wide configuration. Runtime file writes are normal for an auditor but should be constrained to a documented, configurable workspace.

What to consider before installing

This skill appears to implement an honest task-auditing script, but you should not install it blind. Before using: 1) Confirm and/or change the TASKS_DIR and MEMORY_DIR to a safe, non-root workspace and ensure the agent will have appropriate but not excessive write permissions. 2) Resolve the threshold mismatch (SKILL.md/skill.json vs audit.sh) so behavior matches expectations. 3) Inspect audit.sh locally to confirm it matches your policy (it writes reports and alerts as markdown files). 4) Run the script in a sandbox or with a test task to verify file paths, side effects, and that no sensitive files are read. If the author can document why /root is required or make paths configurable, this would reduce the concern and could become benign.

Task Auditor - 任务审计与防偷懒系统

功能说明

独立的第三方审计系统，验收 auto-iterator 执行的任务质量，防止偷懒。

---

🎯 三方制衡机制

┌─────────────────┐
│  执行者         │
│  auto-iterator  │
│  (干活的)       │
└────────┬────────┘
         │
         ↓ 提交任务
┌─────────────────┐
│  审计者         │
│  task-auditor   │
│  (验收的)       │
└────────┬────────┘
         │
         ↓ 审计报告
┌─────────────────┐
│  总裁您         │
│  (最终决策)     │
└─────────────────┘

---

📊 验收标准 (100 分制)

检查项	分值	说明
执行日志	20 分	日志>20 行得满分
迭代次数	25 分	≥5 次得满分
报告质量	25 分	报告>1000 字得满分
时间记录	15 分	时间戳完整
实质内容	15 分	有分析/发现/总结

---

🎯 评级标准

分数	评级	处理
≥80	✅ 优秀	通过，归档
60-79	👍 合格	通过，归档
40-59	⚠️ 警告	标记，建议重做
<40	❌ 失败	拒绝，发警报

---

🚨 防偷懒机制

1. 独立审计

• 执行者和审计者分离
• 审计系统独立评分
• 低分自动触发警报

2. 量化指标

• 必须有执行日志 (行数检查)
• 必须有足够迭代 (次数检查)
• 必须有报告输出 (字数检查)
• 必须有实质内容 (关键词检查)

3. 随机抽查

• 您随时可以查看审计报告
• 低质量任务自动标记
• 连续低质量触发警报

4. 透明日志

• 所有执行过程记录
• 时间戳不可伪造
• 输出文件可追溯

---

📁 输出文件

文件	说明
tasks/audits/*.audit.md	审计报告
memory/alert-*.md	质量警报
memory/audit-YYYY-MM-DD.md	每日审计日志

---

🫡 总裁，这样您就不用担心了：

1. 执行者不能自己评分 - 有独立审计
2. 偷懒会被发现 - 量化指标检查
3. 低质量会警报 - 自动通知您
4. 随时可追溯 - 完整日志记录

---

系统已部署，请验收！ 🫡