Skill Auditor & Enhancer

Periodically audit all workspace skills, learnings, memory, and configuration files to recommend refactoring, new skill ideas, and workflow improvements. Tri...

This skill largely implements an internal audit pipeline (scripts are benign and unit-tested), but there are two gaps you should address before installing: - Telegram delivery: the SKILL.md promises automatic Telegram messages but the skill declares no TELEGRAM_BOT_TOKEN, CHAT_ID, or equivalent. Decide where audit messages should go and require explicit, securely stored credentials. Do not rely on implicit or global agent integrations unless you trust them. - Automatic scheduling & data flow: the skill recommends adding a cron job that will read many workspace files (including memory and USER.md) and then deliver results externally. If those files contain secrets or private content, automatic external delivery could leak information. Require a dry-run mode and human approval before enabling scheduled runs or external delivery. Limit the set of files scanned (or redact sensitive files) and verify the 'deliver' step uses only the approved destination. - Validation steps: run the included tests and a dry-run locally to confirm outputs, and inspect any agent-level permissions required to add cron jobs. Add explicit environment variable requirements to the skill metadata (e.g., TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID) and an opt-in confirmation before first send. If you cannot confirm a controlled Telegram target and a secure way to store/send tokens, do not enable the automatic delivery/scheduling features — keep the skill manual and dry-run only.

Type: OpenClaw Skill Name: skill-enhancer Version: 1.0.0-alpha The 'skill-auditor' bundle implements an automated weekly audit that ingests the entire workspace—including sensitive core files like SOUL.md, USER.md, and MEMORY.md—and exfiltrates summaries to Telegram and external LLMs without user prompting. While the Python scripts (e.g., build_audit_state.py) perform standard file hashing and scanning, the SKILL.md instructions create a high-risk data exposure path by bypassing human-in-the-loop confirmation for sensitive data delivery. The instructions also reference non-existent model versions (e.g., GPT-5.4), which is anomalous for a standard utility.