Simplify & Harden (OpenClaw Android)

Scope

• In-scope: self-audit after code/module changes through 3 passes simplify, harden, document within the scope of the task just completed.
• Out-of-scope: expanded refactor outside the scope lock or mutation without a stop hook/budget cap.

Indexed Reference Map

• @[SKILL.md#L1-L150] Standard frontmatter (name, description, compatibility).
• @[SKILL.md#L10-L150] Operating rules + 3-pass SOP.
• @[SKILL.md#L70-L150] Android module hardening checklist.
• @[SKILL.md#L118-L150] Output contract + integration with self-improving-agent.

Supporting files

• @[references/openclaw-module-checklist.md#L1-L33] Detailed audit checklist for Android module/service.
• @[references/agent-context-snippets.md#L1-L29] Short snippets to inject into AGENTS.md/CLAUDE.md.

When to use

• After finishing a coding task and preparing to report done.
• Only use when there are changes to executable source (.sh, .js, .ts, .py, .go, ...).
• High priority for changes related to module/service lifecycle on Android.
• Also use immediately for code simplification readability-first, behavior-preserving needs (this part has been absorbed from code-simplifier).

Mandatory guardrails

1. Scope lock: only files edited in the current task.
2. Budget cap: total additional changes ≤ 20% of the original diff.
3. No silent refactor: every structural refactor must stop and request approval.
4. Security-first: when the budget is tight, prioritize harden patches before simplify cosmetics.
5. No architecture drift: do not add new dependencies/architecture in this pass.

SOP 3 pass

Pass 1 — Simplify

Goal: clean noise and clarify intent without changing architecture.

Apply automatically (no need to ask):

• remove dead code/unused imports/debug leftovers
• rename ambiguous variables/functions
• flatten deeply nested if branches with early return
• reduce unnecessary visibility

Refactor candidate (must request approval):

• merge/split functions that are structural
• change abstraction boundary
• change the main processing flow

Pass 2 — Harden

Goal: close security gaps + runtime resilience.

Apply automatically:

• add input bounds/type checks
• block basic command/path injection
• remove hardcoded secrets
• standardize error handling without exposing sensitive information

Security refactor (must request approval):

• change auth/authz flow
• change privilege boundary
• change security-sensitive data flow with architectural impact

Pass 3 — Document (micro)

• Add at most 5 short comments for non-obvious decisions.
• Only write why, do not restate obvious what.

Harden Checklist for Android Module

Runtime/script safety

• Validate input from env/args before use.
• Quote shell variables fully ("$var"), avoid word-splitting.
• Avoid eval; if required, sanitize strictly.
• Do not run destructive commands outside the runtime dir scope.

Service lifecycle

• start|stop|status|restart|log consistent.
• Handle stale PID correctly.
• Healthcheck failures must fail-fast, not report fake running status.

Install/upgrade safety

• Detect fresh vs upgrade clearly.
• Upgrade must back up/restore config at minimum.
• Do not delete user data outside the module namespace.

Data/security

• Do not log token/secret/PII.
• Config/secret file permissions at minimum necessary.
• Do not hardcode sensitive system paths.

Refactor Stop Hook (mandatory)

Prompt template when there is a refactor:

[simplify-and-harden] Refactor proposal:
- Why: <why the refactor is needed>
- Impact: <file + estimated diff>
- Risk: <main risk>
Action? [approve] [reject] [show diff] [skip all]

If the user chooses skip all, continue harden/document and record status skipped_by_user.

Output contract

Must return a summary block:

simplify_and_harden:
  version: "2.1.0-merged-code-simplifier"
  scope:
    files_reviewed: []
    original_diff_lines: 0
    additional_changes_lines: 0
    budget_exceeded: false
  simplify:
    cosmetic_applied: []
    removed_complexity: []
    renamed: []
    refactor_proposed: []
  harden:
    patches_applied: []
    critical_flagged: []
    advisory_flagged: []
  document:
    comments_added: 0
  validation:
    behavior_preserving_reasoning: []
  summary:
    review_followup_required: false

Set review_followup_required: true if there are unresolved flags / skipped refactor / budget_exceeded.

Learning loop integration

After each skill run:

1. Standardize findings into pattern_key (e.g. simplify.dead_code, harden.input_validation).
2. Send findings to self-improving-agent to log .learnings/LEARNINGS.md.
3. If repeated enough times (>=3 times, >=2 tasks, within 30 days) then promote the rule into AGENTS.md/TOOLS.md/SOUL.md.

Trigger Rules

• Positive: Trigger when the user request matches simplify-and-harden per the description: Self-audit after completing code/module changes on Android OpenClaw; run 3 passes simplify, harden, document with scope lock + budget cap + stop hook for refactor.
• Negative: Do not trigger for requests outside scope or that do not need the workflow/expertise of this skill.
• Escalation: If there is external action/network write or sensitive operation, add an approval checkpoint before execution.

Output Contract

• Deliverable: results aligned to the goal of simplify-and-harden; clearly state artifact/path/steps performed (if any).
• Validation: report PASS/FAIL status together with the main checks run.
• Failure mode: when failing, state the root cause + proposed remediation.

Error Handling

• If missing input/permissions: report what is missing and request it clearly.
• If runtime/tool error: return a short error + likely cause + proposed remediation.
• If there is policy/safety risk: stop and escalate via approval checkpoint.