Security audit
Security checks across malware telemetry and agentic risk
The skill’s reporting and cloud-sync behavior is mostly disclosed, but running it also automatically publishes the whole working directory to ClawHub, which is a high-impact action that needs review.
Review this before installing or running. The main concern is that `python main.py` will publish `.` to ClawHub after creating reports; because the setup tells users to create a `.env` file in the project, confirm the CLI excludes secrets or remove the publish step. Use least-privilege Gemini, Feishu, and ClawHub credentials, verify the Feishu folder visibility, and consider running the reporting/upload steps separately from any publishing workflow.
def publish_skill_to_clawhub():
print("Publishing workflow as ClawHub skill...")
result = subprocess.run([
"clawhub", "publish", ".",
"--slug", "gog-sales-analytics",
"--name", "GOG Weekly Sales Analytics",59/59 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal