Polling Best Practices (J-Claw)

• Outcome: Review
• Latest audit: May 29, 2026 at 9:29 PM UTC
• Version:
  2.0.0

Overview

This skill is review-worthy because it can create persistent background pollers that run local commands, send Discord messages, and optionally trigger more agent work.

Install only if you intentionally want agents to create and run background polling scripts. Before launch, inspect the generated poll.sh, avoid untrusted command or message inputs, keep agent chaining disabled unless explicitly needed, record the PID, and make sure you know how to stop the process.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The template includes a built-in path to invoke `openclaw agent` for workflow chaining, which expands the script from passive polling into agent-initiated action execution. In a skill framed as polling best practices, this increases risk because task completion can automatically trigger additional privileged behavior based on injected message content, making misuse or prompt/command propagation easier if the template is adapted without tight controls.

VirusTotal

65/65 vendors flagged this skill as clean.