Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to do what it claims: create a new local OpenClaw assistant agent and update local OpenClaw configuration.
Install this only if you want a skill that can add local OpenClaw assistant agents. Before running it, review or back up ~/.openclaw/openclaw.json and expect new workspace and agent directories under /home/admin/.openclaw; use an explicit confirmation workflow if accidental agent creation would be disruptive.
The functionality section emphasizes automation and one-click deployment but does not clearly warn that running the skill creates directories, copies files, and edits openclaw.json. Users may invoke it assuming it is informational or low risk, increasing the chance of unsafe local changes in environments where skill execution is triggered from natural language.
The README advertises very broad natural-language triggers such as '新增一个 agent' and '加一个日常助手' without any confirmation step or narrowing constraints. In an agentic environment, this can cause unintended invocation from casual user phrasing, leading to automatic creation of agents and configuration changes on the local system.
The skill instructs execution of a deployment script and documents writes to agent directories and ~/.openclaw/openclaw.json, but it declares no permissions or allowed-tools scope. That mismatch weakens least-privilege controls and makes unintended or overly broad filesystem/configuration modification easier if the skill is invoked.
The top-level description and trigger examples are broad enough to match ordinary conversational requests about adding an assistant, increasing the chance the skill auto-invokes in contexts where the user did not intend system deployment. Because this skill performs persistent filesystem and configuration changes, ambiguous triggering materially raises the risk of unintended modification.
The invocation section lists several natural-language phrases but provides no hard boundary between discussion and execution, nor any requirement for environment or authorization checks. In a skill that creates directories and edits live configuration, this ambiguity can cause accidental or unauthorized deployment actions.
This section describes creating new workspaces, creating agent directories, modifying ~/.openclaw/openclaw.json, and restarting the gateway, but it does not prominently warn that these are persistent system changes. Users or orchestrators may treat the skill as routine assistance rather than an administrative action, increasing the chance of disruptive or unauthorized changes to the agent environment.
The top-level docstring states the skill behavior in Chinese and specifies the agent as a '日常助手', indicating a Chinese-language/localized assistant setup without any visible option for user language choice. This is a natural-language locale constraint and no opt-in or justification is documented in the file.
The README presents the skill description and example invocation phrases exclusively in Chinese, including instructing users to '直接说' specific Chinese phrases to activate it. This imposes a language expectation without offering user choice, opt-in, or justification for a locale-specific audience.
The manifest description and trigger examples are presented in Chinese, which implicitly constrains usage language but does not state that the skill is Chinese-only or offer an alternative language option. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The package description is written entirely in Chinese, which signals a fixed language choice in the skill's natural-language metadata. There is no indication that users can choose another language or that the Chinese-only description is required for a region-specific purpose.
