- [2026-03-04T18:56:49Z] WARN: security audit may be stale: newest audit artifact security-audit.sh is 42.5h old. Suggested fix: review and address if persistent.
[2026-03-04T21:38:45Z] check: security audit findings present (1 critical, 2 warn) | fix: review plugin acpx.bak, set plugins.allow allowlist, rerun openclaw security audit --deep
[2026-03-05T04:28:00Z] WARN hooks-missing: 0 hooks installed (expected: session-memory, command-logger, bootstrap-extra-files, boot-md). Fix: run `openclaw hooks install <pack>` for each required hook.
[2026-03-05T04:28:00Z] WARN security-audit-stale: no recent `openclaw security audit --deep` result found. Fix: run `openclaw security audit --deep` and save output to memory/.
[2026-03-05T21:33:31Z] RESOLVED hooks-missing: `openclaw hooks` reports 5/5 ready (boot-md, bootstrap-extra-files, command-logger, model-skill-injector, session-memory).
[2026-03-05T21:36:00Z] RESOLVED security-audit-stale: ran `openclaw security audit --deep`; freshness restored.
[2026-03-05T21:36:00Z] CRITICAL security-audit-findings: latest deep audit = 1 critical, 2 warn, 1 info. Key issue: extension plugin `acpx.bak` flagged for dangerous exec pattern.
[2026-03-05T21:41:39Z] ACTION quarantine: moved `~/.openclaw/extensions/acpx.bak` -> `~/.openclaw/extensions-quarantine/acpx.bak.20260305T214139Z` (non-destructive).
[2026-03-05T21:42:00Z] RESOLVED security-audit-findings: `openclaw security audit --deep` now reports 0 critical, 0 warn, 1 info.
[2026-03-09T00:16:00 UTC] WARN security-audit-freshness: latest deep audit is ~74.56h old; run `openclaw security audit --deep`.
[2026-03-09T00:16:00 UTC] WARN expected-service-posture: ports 18801/18802/18803 unreachable on localhost; verify containers are running or bound on expected LAN IPs.
2026-03-09T17:43:56Z | warning | security.trust_model.multi_user_heuristic | Review trust boundary; if multi-user, set agents.defaults.sandbox.mode=all and restrict runtime/fs tools.
2026-03-09T17:43:56Z | warning | update_available | Update available (npm 2026.3.8); run 'openclaw update' when approved.
