swarm-zap/memory/incidents/startup-health.md

• [2026-03-04T18:56:49Z] WARN: security audit may be stale: newest audit artifact security-audit.sh is 42.5h old. Suggested fix: review and address if persistent. [2026-03-04T21:38:45Z] check: security audit findings present (1 critical, 2 warn) | fix: review plugin acpx.bak, set plugins.allow allowlist, rerun openclaw security audit --deep [2026-03-05T04:28:00Z] WARN hooks-missing: 0 hooks installed (expected: session-memory, command-logger, bootstrap-extra-files, boot-md). Fix: run openclaw hooks install <pack> for each required hook. [2026-03-05T04:28:00Z] WARN security-audit-stale: no recent openclaw security audit --deep result found. Fix: run openclaw security audit --deep and save output to memory/. [2026-03-05T21:33:31Z] RESOLVED hooks-missing: openclaw hooks reports 5/5 ready (boot-md, bootstrap-extra-files, command-logger, model-skill-injector, session-memory). [2026-03-05T21:36:00Z] RESOLVED security-audit-stale: ran openclaw security audit --deep; freshness restored. [2026-03-05T21:36:00Z] CRITICAL security-audit-findings: latest deep audit = 1 critical, 2 warn, 1 info. Key issue: extension plugin acpx.bak flagged for dangerous exec pattern. [2026-03-05T21:41:39Z] ACTION quarantine: moved ~/.openclaw/extensions/acpx.bak -> ~/.openclaw/extensions-quarantine/acpx.bak.20260305T214139Z (non-destructive). [2026-03-05T21:42:00Z] RESOLVED security-audit-findings: openclaw security audit --deep now reports 0 critical, 0 warn, 1 info. [2026-03-09T00:16:00 UTC] WARN security-audit-freshness: latest deep audit is ~74.56h old; run openclaw security audit --deep. [2026-03-09T00:16:00 UTC] WARN expected-service-posture: ports 18801/18802/18803 unreachable on localhost; verify containers are running or bound on expected LAN IPs. 2026-03-09T17:43:56Z | warning | security.trust_model.multi_user_heuristic | Review trust boundary; if multi-user, set agents.defaults.sandbox.mode=all and restrict runtime/fs tools. 2026-03-09T17:43:56Z | warning | update_available | Update available (npm 2026.3.8); run 'openclaw update' when approved.