openclaw-self-healing

Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles.

Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands.

Never pipe curl/wget output directly to a shell interpreter.

Review this persistence pattern. Skills should not modify system startup configuration.

Re-evaluate the necessity of `--trust-workspace`. If full access is required, implement strict input validation and sanitization for any data fed to the LLM. Consider using a more constrained execution environment (e.g., a container or a sandboxed shell) for the AI agent to limit potential damage. Implement robust monitoring and auditing of commands executed by the AI.

Avoid downloading and executing scripts directly from unpinned remote URLs. Instead, package all necessary scripts within the skill itself or use a secure package manager with cryptographic verification. If remote fetching is unavoidable, pin to specific commit hashes or use cryptographic hashes to verify script integrity before execution. Implement strict access controls on the downloaded scripts.

Verify this environment variable access is necessary and the value is not exfiltrated.

Verify this environment variable access is necessary and the value is not exfiltrated.

Verify this environment variable access is necessary and the value is not exfiltrated.

Implement stricter controls over what information Claude is allowed to output to the session log, especially when operating with `--trust-workspace`. Redact sensitive patterns from logs before exfiltration. Ensure that the LLM's prompts and context are carefully managed to prevent it from revealing confidential data. Regularly audit the content of these logs for sensitive information.