Self Optimizer

Analyzes OpenClaw logs, chat history, and the .openclaw installation to propose self-improvement and optimization suggestions. Use when optimizing or auditin...

This skill appears to do what it says (parse logs and analyze chat history). Before installing or running it, review the full script (the provided file was truncated in the listing) to confirm there are no network exfiltration calls or subprocess launches in later code. Only run it from a trusted location and in a controlled environment because it will read local files such as gateway.log, openclaw.log, and potentially openclaw.json — these can contain API keys and other secrets. If you plan to run it, either (1) run it on a copy of the logs/configs with secrets redacted, (2) inspect the entire source code for any outbound network I/O or unexpected writes, or (3) run it in a sandboxed environment. If you need higher assurance, ask the author for a full source audit or for the missing/truncated portion of the script before proceeding.

Type: OpenClaw Skill Name: self-optimizer Version: 0.1.0 The skill is designed for legitimate diagnostic purposes, analyzing OpenClaw logs and chat history. However, the `scripts/self_optimizer.py` script contains a local file inclusion (LFI) vulnerability. The `--chat-history-file` argument allows the script to read and parse any JSON file on the filesystem, which could be exploited by a malicious prompt to the agent to exfiltrate sensitive configuration or credential files if they are in JSON format and accessible to the agent.