Security audit
Security checks for vulnerabilities and agentic risk
This skill has a coherent daily reporting purpose, but it ships unsafe defaults that can send local operational summaries to a preset Discord destination using an embedded gateway credential.
Review this skill before installing or scheduling it. Remove the embedded gateway token, disable Discord by default, replace the bundled channel ID with your own confirmed destination, and inspect the exact outgoing report payload. Treat failure logs, daily notes, and memory files as potentially sensitive, and do not blindly run the recommended skill install commands without separately reviewing those packages.
scripts/run.cjs:369Hardcoded OpenClaw Gateway Bearer Token
config/settings.json:4Outbound Discord Reporting Enabled with a Preset Recipient
scripts/run.cjs:187Unpinned Third-Party Skill Installation Recommendations
The script embeds a fallback bearer token directly in source code and uses it automatically when the environment variable is absent. Hardcoded credentials can be extracted by anyone with code access and may permit unauthorized use of the local gateway or connected messaging functions, especially in an automated skill that sends outbound messages.
A hardcoded fallback credential is used silently for Authorization, creating a secret exposure and unsafe default authentication path. If the token is valid, an attacker or unintended user could reuse it to send messages or interact with the gateway without proper secret management or user awareness.
The documented workflow collects user corrections and daily notes, stores derived content in memory, searches for improvements, and pushes generated reports to Discord. This creates a clear natural-language exfiltration path: sensitive information from user interactions or internal logs can be summarized and transmitted externally, and summarization does not reliably remove secrets or private data.
The README explicitly describes updating memory files, generating reports from failures/corrections/notes, and delivering the result to Discord, but it provides no warning, minimization guidance, or redaction requirements. In this skill context, those sources are likely to contain sensitive user content, operational details, or prompts, so exporting summaries to an external channel creates a realistic privacy and data-leakage risk.
The skill advertises behavior that reads local files, searches external resources, and pushes reports to Discord, but it does not declare any explicit tool scope or permission boundaries. In a skill system, missing scope declarations can allow broader-than-expected access to environment data or execution capabilities, reducing user visibility into what the skill may touch.
The skill description and usage flow state that it reads failure logs, daily notes, and corrections, then generates and sends a report to Discord, but there is no prominent privacy warning or consent language. This creates a real risk of unintentionally exfiltrating sensitive user content, including personal notes, correction history, or operational details, to a third-party service.
The package description is written entirely in Chinese and presents the skill behavior in that locale without any indication that users can choose another language. Under the policy, language or locale constraints should be optional or clearly justified; this manifest provides neither.
Natural-language strings and date formatting are hardcoded to Chinese, including use of zh-CN locale and Chinese-only console/report text. This creates a language policy concern because the skill does not offer a language choice or explain why the locale is fixed.
The manifest and file header describe searching ClawHub for improvement ideas, which implies querying an external catalog or dynamic source. In the implementation, the 'search' step is a static in-code array of suggestions with minor local conditional additions, so the advertised behavior is not actually carried out.
The section header and log output explicitly describe a ClawHub search operation. The code beneath it performs no network request, subprocess call, or catalog query, so the documentation actively misrepresents what the code does.
The stated purpose focuses on collecting issues, analyzing patterns, generating a report, and pushing it to Discord. Appending content into the existing daily note is an additional write-side behavior that changes user workspace content and is not disclosed in the manifest description.
The script collects workspace-derived issue summaries and transmits them to Discord via a local messaging gateway without any explicit consent flow, sanitization policy, or clear user warning at send time. In the context of a self-improvement skill that reads failure logs and notes, this can leak sensitive operational details, task names, and error content to an external channel.
The README presents the skill description and usage in Chinese and even hard-codes the scheduled message in Chinese, but does not indicate that the skill is intentionally region-specific or provide an alternative language option. This can violate a language/locale policy when users are not given a choice or informed of the restriction.
The manifest description and the rest of the skill instructions are written entirely in Chinese, and the scheduled invocation message is also fixed in Chinese. There is no indication that the skill is region-specific or that users can opt into another language, which may violate language/locale policy requirements.
The setting "timezone": "Asia/Shanghai" imposes a specific locale preference in configuration, which can amount to a language/locale policy constraint when not paired with user choice or clear region-specific justification. In this file, there is no indication that the timezone is optional, user-selected, or required for a region-specific compliance purpose.
Detected: suspicious.env_credential_access, suspicious.potential_exfiltration