Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed email-approval workflow that requires human approval before sending external messages.
Review the configured recipients, sender identity, /root/.openclaw/workspace paths, and email_manager.py setup before use. Treat the CSV audit log as potentially sensitive because it can reveal who was contacted and why.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
**NOT approved by:**
- "Looks good" (needs explicit send instruction)
- "OK" (ambiguous)
- Silence (never assume approval)
## Examples
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### If no response to approval request:
1. Wait minimum 1 hour
2. Send polite follow-up: "Just checking if you had a chance to review the draft?"
3. Never send without approval
## Integration with Agents
The workflow logs recipient identifiers, purpose, timestamps, and approval status into a local CSV audit trail without any stated data minimization, retention, access control, or privacy notice. While operationally useful, this can expose contact and communication metadata to other local users, backups, or downstream tooling and may create unnecessary privacy/compliance risk.
No suspicious patterns detected.