Security audit
proactive-companion
Security checks for vulnerabilities and agentic risk
Overview
The skill's files and installer broadly match a Telegram notification companion, but there are multiple mismatches and system-level actions (silent history scanning, patching global routing, enabling exec profile, cron persistence, undeclared Telegram config) that warrant caution before installing.
What to consider before installing: - Metadata mismatch: the registry says no env vars, but install.sh expects a Telegram chat ID (OPENCLAW_TELEGRAM_NR). Expect to provide that and verify how it's stored (the installer writes a .env file). - Persistence & system changes: the installer creates a recurring cron job, injects an onboarding trigger immediately, attempts to patch /data/.openclaw/SOUL.md (global routing), and tries to set openclaw tools.profile to 'coding' (enables exec via gateway). These are system-wide changes — back up SOUL.md and any config before proceeding. - Silent data collection: SOCIAL.md directs the skill to scan the last ~50 messages for personal/social data and to 'silently' write social_knowledge.json. If you are uncomfortable with the agent automatically extracting and persisting facts from conversation history, do not install or inspect/modify the code to remove that behavior. - Inspect the code before running: review proaktiv_check.py and interest_evolve.py for any network calls, third-party endpoints, or unexpected external data exfiltration. The partial feedback_update.py is benign-looking (file I/O, sentiment heuristics), but full review of proaktiv_check.py is required to confirm there are no remote endpoints or telemetry. - Run in a sandbox first: if possible, install in a non-production or isolated OpenClaw instance to observe behavior (cron, outbound network, file writes) before granting it your real chat/session. - Deny tool/profile changes until verified: don't allow openclaw config changes (tools.profile) or SOUL.md patches without understanding implications; these increase privilege and can broaden what the agent can execute. - If you proceed: make sure the .env file permissions are secure (installer sets 600), check what data is persisted under /data/.openclaw/skills/proaktiv/, and have an uninstall or remediation plan (remove cron, restore SOUL.md, delete skill directory). Additional info that would change this assessment: seeing the full proaktiv_check.py and interest_evolve.py code (to confirm no remote exfiltration or hidden endpoints) and an explicit manifest declaring required env vars and the rationale for changing openclaw tools.profile and SOUL.md would increase confidence and could move the evaluation toward 'benign'.
Static analysis
No suspicious patterns detected.