Security audit
Security checks for vulnerabilities and agentic risk
The skill is not clearly malicious, but it automatically installs a companion auditor and writes workspace memory files, so users should review it before use.
Install only if you want an agent to manage session handoffs and audit OpenClaw workspace files. Before first run, review the embedded buffer-optimizer content and scripts, decide whether automatic companion-skill creation is acceptable, and back up or protect any existing HANDOFF.md and MEMORY.md content you do not want replaced or rewritten.
Beyond session preservation, the embedded optimizer performs workspace and system skill enumeration, boot-payload measurement, ghost-file detection, and other inventory-style checks. Those capabilities materially broaden access patterns and could expose file names, configuration structure, and local environment details without clear up-front disclosure.
Beyond session preservation, the embedded optimizer performs workspace and system skill enumeration, boot-payload measurement, ghost-file detection, and other inventory-style checks. Those capabilities materially broaden access patterns and could expose file names, configuration structure, and local environment details without clear up-front disclosure.
The README mentions that a companion skill, 'buffer-optimizer,' is extracted automatically on first run, but this behavior is embedded in descriptive text rather than highlighted as a security-relevant action. Automatically introducing a second skill changes the trusted code footprint and can lead to unexpected persistence or broader workspace access, which is especially risky in an agent environment where users may not review generated artifacts before execution.
The README mentions that a companion skill, 'buffer-optimizer,' is extracted automatically on first run, but this behavior is embedded in descriptive text rather than highlighted as a security-relevant action. Automatically introducing a second skill changes the trusted code footprint and can lead to unexpected persistence or broader workspace access, which is especially risky in an agent environment where users may not review generated artifacts before execution.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
## First Run
Check if `buffer-optimizer` exists as a sibling skill directory. Look for `skills/buffer-optimizer/SKILL.md` relative to your workspace.
**If it does NOT exist**, extract it now:
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
## First Run
Check if `buffer-optimizer` exists as a sibling skill directory. Look for `skills/buffer-optimizer/SKILL.md` relative to your workspace.
**If it does NOT exist**, extract it now:
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
## First Run
Check if `buffer-optimizer` exists as a sibling skill directory. Look for `skills/buffer-optimizer/SKILL.md` relative to your workspace.
**If it does NOT exist**, extract it now:
The skill automatically scaffolds and installs a second skill on first run, including setup actions that modify workspace state. Self-replicating or self-installing behavior is risky because it expands the code/instruction surface and persists new agent capabilities without a clear, separate consent step.
The skill instructs the agent to create directories and write multiple files in the workspace automatically, but the top-level description does not warn that it performs persistent modifications. Silent or implicit file creation can overwrite local conventions, surprise the user, and normalize write actions beyond the expected scope of a session-management helper.
The wrap procedure directs the agent to overwrite HANDOFF.md with current state, creating a clear risk of destroying prior content or user-maintained notes if the file is shared or manually edited. Overwrite semantics without backup, merge, or confirmation can lead to accidental data loss.
The skill embeds shell scripts that enumerate workspace files, inspect system directories, and audit AGENTS.md structure, which exceeds what is strictly necessary for basic session management. Creating executable scripts inside the workspace increases persistence and the chance that later sessions will run broader local inspections than intended.
The Start section tells the agent to avoid reading other files unless required by the task, implying minimal file access during normal operation. Elsewhere, the embedded first-run/setup and audit flows direct reading AGENTS.md, MEMORY.md, HANDOFF.md, memory/*.md, root markdown files, and skill inventories for workspace auditing, which contradicts that narrow-access guidance.