BotLearn Healthcheck

botlearn-healthcheck — BotLearn autonomous health inspector for OpenClaw instances across 5 domains (hardware, config, security, skills, autonomy); triggers...

This skill appears to do what it says (a deep OpenClaw health audit) but its runtime instructions tell the agent to autonomously read many sensitive files and run local OpenClaw CLI commands. Before installing or enabling it: 1) only install from a trusted publisher; 2) review the contents of $OPENCLAW_HOME (openclaw.json, identity/, logs, cron/) to understand what data would be exposed; 3) consider running the checks in a low-privilege or isolated/test environment first; 4) if possible, enforce a policy that the agent must ask for explicit user confirmation before reading or transmitting sensitive files; and 5) verify what the agent will do with collected data (where reports are sent/stored). If you cannot verify the skill's origin or you cannot isolate the environment, avoid enabling it with full access.

Type: OpenClaw Skill Name: xiaoding-botlearn-healthcheck Version: 1.0.7 The skill bundle defines an autonomous diagnostic tool with broad access to sensitive system data, including configuration files (openclaw.json), identity listings, and gateway logs. While SKILL.md includes explicit instructions for the agent to redact credentials and seek user confirmation before executing fixes, the extensive data collection and reliance on multiple external shell scripts (e.g., scripts/collect-security.sh and scripts/collect-env.sh) constitute high-risk capabilities. The intent appears to be a legitimate health check, but the broad permissions and potential for sensitive data exposure via the reporting mechanism warrant a suspicious classification.