Proactive Trigger

主动触发引擎v4：基于兴趣衰减、沉默检测、话题热度，决定何时进行主动干预。触发条件：用户沉默、兴趣衰减、主动干预时机成熟。

What to check before installing: - Understand where it writes: it stores state, signals and logs at ~/.openclaw/workspace/.soul (or /tmp fallback). If you want to limit exposure, run it in a sandbox or container and inspect that directory. - Review the code paths that call external commands: openclaw-tool calls execSync with interpolated parameters. If an openclaw CLI is present, untrusted signal payloads could lead to shell injection. Consider removing/locking out the OpenClaw CLI or running with limited privileges. - If you will run npm install, prefer doing so in an isolated environment and review package.json. The dependencies are standard (date-fns, commander, chalk) and there are no external download URLs. - Audit where signals originate in your agent/system. If external/untrusted sources can create signals or payload fields, make sure to sanitize them or disable CLI invocation (check openclaw-tools.js callTool) before enabling automatic processing. - Run the included tests (npm test) in a safe environment, inspect generated files, and consider setting processSignalsOnStartup=false in the config until you’re confident about behavior. If you need, I can point to the exact lines that create the command-injection risk and suggest concrete code fixes (use child_process.spawn with argument array, or strictly validate/escape inputs).