Security audit
Security checks across malware telemetry and agentic risk
This skill is a disclosed local evaluation tool that reads OpenClaw runtime metrics, runs scoped test commands, and writes evaluation reports, with optional network judging only when explicitly enabled.
Install only in a trusted OpenClaw workspace. Review or redact local state files if they may contain sensitive prompts or operational data, keep generated reports private unless safe to share, and use --llm-judge only when you are comfortable sending score summaries, evidence metrics, and risk flags to the configured LLM provider.
# ---------------------------------------------------------------------------
def run_cmd(command: list[str], timeout: int = 120) -> subprocess.CompletedProcess:
return subprocess.run(command, cwd=str(WORKSPACE),
capture_output=True, text=True, timeout=timeout)headers={'Content-Type': 'application/json', 'Authorization': f'Bearer {api_key}'},
)
try:
with urllib.request.urlopen(req, timeout=15) as resp:
body = json.loads(resp.read())
text = body['choices'][0]['message']['content'].strip()
if text.startswith('```'):66/66 vendors flagged this skill as clean.
Detected: suspicious.dynamic_code_execution