Subagent Watchdog

Monitors subagent runs by enforcing a completion marker file before a deadline and alerts or exits if the marker is missing.

This skill appears to implement the advertised watchdog behavior, but review these points before installing or running it: - The script will run a short Python snippet (python3) to read ~/.openclaw/openclaw.json when you omit the wait_seconds argument. If that file is missing or malformed the script will error due to 'set -e' and the unguarded open() call. To avoid this, always call ./watch.sh <label> <wait_seconds>, or ensure the config file exists and is valid. - The script can call an external openclaw binary to send notifications if WATCHDOG_CHAT_ID (and an executable OPENCLAW_BIN) are present. If you do not want any external notifications, do not set WATCHDOG_CHAT_ID or set OPENCLAW_BIN to a non-executable path. - The registry metadata does not declare optional deps/envs: python3, OPENCLAW_CONFIG_PATH, OPENCLAW_BIN, WATCHDOG_CHAT_ID, WATCHDOG_CHANNEL, STATE_DIR. Treat these as implicit and verify they are safe/trusted in your environment before use. - The watchdog reads user config (~/.openclaw/openclaw.json). If that file contains sensitive information, be aware the skill will open it (only to read maxRuntimeSeconds in current code), and the script may fail if it's unreadable. Consider running the script in a controlled directory or with explicit wait_seconds. - If you plan to rely on the OpenClaw messaging integration, audit the openclaw binary you will point to so you trust what it transmits. The watchdog’s message text is small (label + timeout), but any external binary could behave differently. Overall: functional and small, but the missing declarations and the unguarded config read are reliability/privacy issues — fix or document these before deploying widely.

Type: OpenClaw Skill Name: subagent-watchdog Version: 0.1.0 The skill is classified as suspicious due to a path traversal vulnerability in `watch.sh`. The `LABEL` argument, which is user-controlled, is directly used to construct the path for the completion marker file (`$STATE_DIR/${LABEL}.done`). This allows a malicious subagent or user to write files to arbitrary locations on the filesystem by providing a `LABEL` containing path traversal sequences (e.g., `../`). While the skill's stated purpose is benign, this lack of input sanitization presents a significant security risk, allowing for unauthorized file creation or modification.