Ray Delivery Diagnosis

Automates delivery lane scans every 4 hours to detect failures, classify issues, update recovery tickets, and attempt specified recovery actions.

This skill appears to be a runbook that will run local Node scripts and modify mission-control/recovery-ticket files. Before installing or enabling it: 1) Confirm that the runtime environment actually contains the referenced scripts and that you trust their contents — ask for the script sources or inspect them in a safe environment. 2) Verify Node is available and consider declaring it as a required binary. 3) Determine what credentials are needed (Facebook/X tokens, Supabase URL, any posting API keys) and provide them only with least privilege; the skill does not declare these. 4) Run initially in a sandbox/test environment and use dry-run flags as suggested; review the outputs it would write to mission-control and recovery tickets. 5) If you cannot inspect the referenced scripts, treat the skill as untrusted: it could run arbitrary code that reads local dotfiles (~/.openclaw), writes ticket files, or transmits data. 6) Ask the publisher for provenance (source repository, maintainers) and for explicit declarations of required binaries and credentials before using it in production.

Type: OpenClaw Skill Name: ray-delivery-diagnosis Version: 1.0.0 The skill is classified as suspicious because it utilizes high-risk capabilities such as shell execution and sensitive file access, which are explicitly flagged in the analysis criteria. Specifically, SKILL.md and TEMPLATE.md instruct the agent to execute multiple local scripts (e.g., postiz-publish.mjs, facebook-poster.mjs) and read environment configuration files from other workspaces (~/.openclaw/workspace-jenny/.env). While these actions are aligned with the stated purpose of task recovery and delivery diagnosis, the reliance on shell execution and cross-workspace file access represents a significant security surface.