Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent local task-queue skill, but it adds persistent heartbeat and hook automation that can queue or trigger agent work across workspaces without much containment.
Install only if you want durable agent-task automation. Review HEARTBEAT.md changes before using --write, avoid setup-heartbeat --all unless you intend to affect every discovered workspace, and enable the OpenClaw hooks only in trusted workspaces where automatic task creation from replies is acceptable.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
bash ./script.sh setup-heartbeat --write
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
This uses a managed block in HEARTBEAT.md and updates that block in place instead of overwriting the whole file. The generated command binds the target workspace explicitly with AGENT_TODO_WORKSPACE=..., so shared/external skill installs still read the correct local queue.
bash ./script.sh add "Publish release" \
文档说明 setup-heartbeat --all --write 会对发现到的 workspace 追加或更新托管块，这属于跨多个工作区的批量文件写入操作。当前描述强调“不覆盖整份 HEARTBEAT.md”，但未明确提醒用户该命令会自动修改多个文件，可能影响范围超出当前 workspace。
该 markdown 文件展示了 bash ./script.sh setup-heartbeat --write 的直接用法，这是会对工作区中的 HEARTBEAT.md 进行写入的文件修改操作。文档虽在前文说明“只追加或更新托管块”，但没有在快速开始或命令说明中给出明显的用户警示，提醒该命令会改写文件内容并可能影响现有工作流文件。
The description lists triggers such as "follow-up work" and "background tasks," which are generic phrases that could match many ordinary agent activities. The file does not provide exclusion conditions or negative examples clarifying when this skill should not be invoked, increasing the risk of unintended activation.
The skill instructs users to persist task execution into HEARTBEAT.md via setup-heartbeat --write, including an --all mode that updates every discovered workspace. This creates session persistence that can repeatedly trigger task execution across workspaces, increasing the blast radius of mistakes, abusive task routing, or compromised queue contents. In this context, the persistence is intentional and part of the feature set, but it still meaningfully raises security risk because it establishes durable automation hooks.
bash ./script.sh done --note "what was completed" bash ./script.sh report bash ./script.sh block --reason "why blocked" bash ./script.sh setup-heartbeat --write bash ./script.sh setup-heartbeat --all --write
The manifest description contains broad activation cues such as 'do something later', 'background tasks', 'follow-up', and 'heartbeat automation' that could match ordinary user conversation rather than an explicit request to invoke this skill. In an agentic environment, that increases the chance of unintended activation and autonomous task queuing, which can cause actions to be scheduled or executed without sufficiently clear user intent.
The activation logic relies primarily on Chinese natural-language phrases such as '我会' and '我来' to detect commitments. This creates a language-specific behavior that is not presented as optional or configurable, which can violate language/locale neutrality expectations.
This hook automatically converts reply text into queued tasks and may dispatch them to an agent based solely on pattern matching, with no user confirmation or authorization check visible in this file. That creates an integrity and abuse risk: a forum reply containing trigger phrases can cause unintended task creation, noisy automation, or adversary-induced work execution under another agent identity.
This markdown file instructs the user to copy hook scripts into a live hooks directory and later configures automatic execution via heartbeat and cron, but it does not warn that these hooks will execute shell scripts and may modify local task state automatically. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect system integrity or user data.
The guide instructs users to copy hook scripts into a persistent user hooks directory and enable them, which establishes automatic execution on future OpenClaw events. That persistence can be dangerous because any unsafe behavior in the installed scripts will continue to run implicitly with the user's privileges across sessions, increasing blast radius and making abuse harder to notice.
mkdir -p ~/.openclaw/hooks/agent-todo
cp -r ./hooks/* ~/.openclaw/hooks/agent-todo/
The reply hook is described as activating on specific Chinese phrases such as “我来处理” and “我会补上”, but the document does not indicate that this behavior is optional, configurable, or limited to a justified Chinese-language deployment. This creates a natural-language locale policy concern because the skill appears to force a specific language context without user opt-in.
The parser recognizes only Chinese-relative date expressions such as 今天, 明天, and 本周, which embeds a specific language assumption into the skill behavior. There is no opt-in, alternate locale handling, or documentation in this file indicating that the skill is intentionally region-specific.
The script reads a global OpenClaw configuration, discovers other agents' workspaces, and can resolve an agent ID into another workspace for task dispatch. This expands the trust boundary from a local todo queue to cross-workspace coordination, which can expose workspace paths and enable writes into other agents' task stores if the operator did not intend that broader scope.
The heartbeat setup logic can modify HEARTBEAT.md not only locally but across all discovered workspaces when --all and --write are used. Because HEARTBEAT.md appears to influence agent behavior, this gives the script the ability to propagate operational instructions into multiple workspaces, broadening impact beyond normal task management.
This markdown file instructs users to run setup commands with --write and later states that the command updates a managed block in HEARTBEAT.md in place. While the behavior is described, it is not presented as a clear caution or warning about modifying files in the user's workspace, which is the kind of user-affecting behavior this rule targets for markdown files.
Line L10 presents a core principle entirely in Chinese, while the rest of the document is in English. This creates a language policy concern because the skill imposes a specific language for part of its instructions without user opt-in or justification.
This markdown file defines behaviors such as writing to the current or target workspace and appending or updating a block in HEARTBEAT.md, but it does not include a warning that these operations modify local files. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or system integrity.
The code persists changes to HEARTBEAT.md by creating parent directories and writing new content, which modifies user workspace files. Although some CLI output indicates when updates occur, there is no nearby comment or explicit user-facing warning that this operation rewrites the heartbeat file contents when --write is used.
No suspicious patterns detected.