Multi User Privacy

Automatically identifies users, isolates memories, filters sensitive content, manages sessions and sub-agents, and enforces role-based privacy and quota cont...

This skill is feature-rich and mostly coherent with a 'multi-user privacy' purpose, but there are several red flags you should check before installing: - Review the code yourself (or have an engineer do it) before running any install/post-install scripts (auto-mount, auto-create-subagents, monitoring start scripts). Those scripts run on your machine and can create services, cron jobs, or write files under ~/.openclaw. - The 'cold-start' flow lets the first user who talks to a fresh instance designate the admin account. On a new deployment that could be any external user — consider disabling or changing this behavior before using in production. - The skill includes a web-admin server and monitoring/alert scripts. If you enable them, make sure they are bound to localhost or protected by authentication and firewall rules. Do not expose the admin UI publicly without auditing it. - The project references external integrations (GitHub publishing, 飞书/other alerts) but declares no required env vars. If you provide tokens/webhooks, audit where they are stored and ensure the code uses them only for intended actions. - Test in an isolated environment (VM/container) first. Verify that automatic subagent creation, pending-queue processing, and sessions_spawn interactions behave as expected and do not create unintended processes or network listeners. - If you plan to use it in a shared or production instance, require an explicit admin approval step for subagent creation and remove/modify the cold-start 'first-user becomes admin' flow. Bottom line: the skill is not obviously malicious, but it performs privileged, persistent, and networked operations; proceed only after code review and running inside a controlled/sandboxed environment.

Type: OpenClaw Skill Name: multi-user-privacy Version: 0.9.2 The bundle implements an extensive multi-user management system but utilizes highly intrusive and insecure methods. Key concerns include 'scripts/auto-inject.js', which monkey-patches the core Node.js 'fs' module to intercept all file read/write operations, and 'scripts/inject-hook.js', which automatically modifies the main application entry points (e.g., main.js) to insert global hooks. Additionally, 'web-admin/server.js' launches a web server on port 3456 that lacks any authentication mechanism, potentially allowing unauthorized network users to manage user quotas and sub-agents. While these features support the stated goal of privacy enforcement, the combination of intrusive system modifications and significant security vulnerabilities warrants a suspicious classification.