Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed CEO-style coordination workspace skill that creates local project files and templates, with no evidence of hidden execution, exfiltration, or destructive behavior.
Install only if you want a durable local coordinator workspace. Review USER.md and MEMORY.md before reuse, do not place passwords or private customer data in memory files, and inspect the separate ceo-xiaomao companion package before installing automation or outreach capabilities.
The skill advertises installation and workspace-initialization commands that create files and directories, but the manifest does not declare any tool scope such as permissions or allowed-tools. That mismatch can mislead users or hosting platforms about the package's effective capabilities, reducing visibility and policy enforcement around filesystem and environment access.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
clawhub install ceo-xiaomao-agent
mkdir -p ~/workspace/ceo-xiaomao
cd ~/workspace/ceo-xiaomao
python3 ~/.openclaw/skills/ceo-xiaomao-agent/scripts/init_agent_workspace.py
The suggested first prompts and boss-facing prompt are all written as direct Chinese-language instructions, including commands to act as CEO小茂, but the document does not state that Chinese is optional or limited to a justified region-specific deployment. This can violate language/locale policy because it steers users into a fixed language without opt-in.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
clawhub install ceo-xiaomao-agent
mkdir -p ~/workspace/ceo-xiaomao
cd ~/workspace/ceo-xiaomao
python3 ~/.openclaw/skills/ceo-xiaomao-agent/scripts/init_agent_workspace.py
The quickstart explicitly creates a persistent workspace and instructs users to edit long-lived files such as USER.md and MEMORY.md, which can encourage retention of sensitive operational context across sessions. In an agent package, persistent memory increases the risk of unintended disclosure, stale sensitive data reuse, or cross-task contamination if the workspace is later accessed by other tools, users, or agent runs.
clawhub install ceo-xiaomao-agent
mkdir -p ~/workspace/ceo-xiaomao
cd ~/workspace/ceo-xiaomao
python3 ~/.openclaw/skills/ceo-xiaomao-agent/scripts/init_agent_workspace.py
The quickstart recommends a Chinese-only first message, which steers users toward a fixed language/locale. The file does not indicate that other languages are supported or that Chinese is optional, so this is a natural-language policy concern under the language-choice rule.
This example prompt is written entirely in Chinese and presents that locale as the default interaction mode. Without any accompanying note that language is user-selectable, the documentation effectively forces a specific language choice.
The file is entirely written in Chinese and defines a fixed persona ('我是 CEO小茂（小茂），不是其他任何人。') without indicating that the user can choose another language or locale. Under the policy rule, hard-coding a language/locale presentation without opt-in can be a natural-language policy violation unless the constraint is explicitly justified.
This markdown template uses Chinese section headings throughout and provides no indication that users may choose another language or locale. That can violate a language-choice policy when a skill implicitly forces a specific language without opt-in.
The template headings are entirely in Chinese and provide no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue.
The example prompt explicitly instructs the skill to start in a specific persona and respond in Chinese using a fixed Chinese section format. This is a natural-language locale choice embedded in the skill example, and the file does not indicate that the user may choose another language or opt in to this locale behavior.
The file presents the agent and team roles using Chinese names and labels throughout, with no indication that users may choose another language or localized naming convention. Under the stated policy, a skill should not impose a specific language or locale without opt-in or documented justification.
This markdown file instructs the user to run an initialization script and then states that it creates several files and folders in the target directory. Because the description does not explicitly warn that the command will write new files into the current workspace, users may not realize it changes local data until after execution.
The phrase 'report to the boss in management language' embeds a specific organizational role assumption in the skill's natural-language behavior. This can be a policy concern if the skill effectively forces a particular role/communication framing without user opt-in or alternative locale/organizational phrasing.
This markdown file presents all operational instructions and reporting structure in Chinese only, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. That can violate the language/locale policy because it effectively forces a specific language for using the skill.
This code initializes a workspace by creating directories and writing several markdown files, and the target location can be influenced by the CEO_XIAOMAO_WORKDIR environment variable. Although it logs what was created after the fact, there is no prior disclosure or confirmation that the script will modify the filesystem at that location.
No suspicious patterns detected.