openclaw-claude-dispatcher
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill claims to dispatch tasks to Claude Code CLI and notify Feishu/WeCom, but its runtime instructions assume local dispatcher scripts, a Claude CLI binary, and notification credentials that are not declared — those mismatches and the default non-interactive 'bypassPermissions' mode are concerning.
Do not enable or run this skill until the following are clarified and fixed: (1) confirm the exact dispatcher scripts exist at the referenced paths and review their contents — they will be executed; (2) confirm Claude Code CLI is installed where the agent can run it and declare that binary in the skill metadata; (3) provide and review the Feishu/WeCom credentials or webhook mechanism the skill will use (these must be declared and restricted), or remove hard-coded group IDs if inappropriate; (4) change the default '--permission-mode' from 'bypassPermissions' to require explicit confirmation or interactive approval for potentially destructive operations; (5) avoid allowing autonomous invocation to perform dispatches without human review unless you fully trust the scripts and environment. If you cannot verify those points, treat the skill as untrusted and refuse to run it.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.