Security checks across malware telemetry and agentic risk
JobClaw mostly does what it claims, but its scheduled workflow has unsafe automatic behavior that can modify records and may mishandle job-derived data.
Review before installing. Use a virtual environment instead of allowing system-wide pip changes, keep notifications disabled unless needed, protect config.json if you store Telegram/OpenClaw credentials, and avoid enabling scheduled runs until the daily runner stops injecting job text into Python code, validates archive-check URLs, and makes dry-run truly read-only.
try:
# HEAD check for status code
result = subprocess.run(
["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}",
"--max-time", "8", "--location", url],
capture_output=True, text=True, timeout=12return False
if 200 <= code < 400:
# GET to check for dead phrases in body
body_result = subprocess.run(
["curl", "-s", "--max-time", "8", "--location", url],
capture_output=True, text=True, timeout=12
)def install_package(package: str) -> bool:
print(f" Installing {package}...")
result = subprocess.run(
[sys.executable, "-m", "pip", "install", package, "--break-system-packages"],
capture_output=True, text=True,
)print(f" ✅ {package} installed.")
return True
# Try without --break-system-packages
result2 = subprocess.run(
[sys.executable, "-m", "pip", "install", package],
capture_output=True, text=True,
)VirusTotal findings are pending for this skill version.