Security audit
Security checks for vulnerabilities and agentic risk
TechPulse is a small disclosed Reddit trend-reporting skill with no hidden persistence, credential use, destructive behavior, or privilege escalation.
Install only if you are comfortable with a Russian-language skill that contacts Reddit's public API to summarize hot posts from hardcoded technology-related subreddits. It does not appear to read private data, use credentials, or modify anything beyond normal installation.
The natural-language content in the skill file is presented only in Russian, which can force a specific language on users without opt-in. The policy allows language constraints only when users are given a choice or when the constraint is clearly documented and justified.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/.openclaw/skills/techpulse
unzip techpulse.zip -d ~/.openclaw/skills/
openclaw restart
The module docstring and function docstrings are written in Russian, which establishes a fixed language for the skill's natural-language interface without offering a user opt-in or documenting that the skill is region-specific. This matches the policy concern for language or locale constraints applied implicitly.
The manifest description lists several broad topics like IoT, EV, Games, DIY, and Tech without specifying concrete trigger phrases, scope boundaries, or exclusion conditions. This ambiguity could cause unintended invocation for common research or technology-related requests.
The natural-language description is presented only in Russian, which may imply a language-specific constraint without any opt-in, alternative language support, or documented regional justification. This can conflict with language/locale policy expectations when users have not chosen that language.
No suspicious patterns detected.