openclaw - 💡(How to fix) Fix Performance: openclaw security audit --deep can stall silently ~9min due to serial skills/plugins code-safety scans [1 pull requests]

Summary

openclaw security audit --deep can spend a long silent window (observed ~548s) and often gets killed by caller-level timeout (e.g. 120s -> SIGKILL/exit 137) when workspace has many skills/plugins files.

From source + runtime evidence, the main bottleneck appears to be deep code-safety collectors scanning multiple directories serially.

Environment

• OpenClaw version: 2026.4.29 (a448042)
• Runtime: macOS 26.4.1, Node 25.6.1
• Command: openclaw security audit --deep

Observed behavior

• Long period of no output while audit still running.
• One successful run completed only after ~548s and then printed summary.
• Earlier runs with external timeout 120s were killed (SIGKILL), resulting in no usable output.
• Memory pressure was normal during incident (free ~92%, swapins/swapouts 0), so this does not look like OOM.

Source-level evidence

• Deep path includes code-safety collectors for plugins/installed skills.
• Those collectors call scanner directory routines that iterate files serially:
  • scanDirectoryWithSummary(...)
  • for (const file of files) { await scanFileWithCache(...) }
• Scanner defaults are currently:
  • DEFAULT_MAX_SCAN_FILES = 500
  • DEFAULT_MAX_FILE_BYTES = 1024 * 1024
• Directory walk is performed by walkDirWithLimit(...).

In local check with many files across skills/plugin dirs (~1435 files across relevant roots), this accumulates into long wall-clock time.

Why this hurts

• Deep audit appears "hung" to users due to long silence.
• External wrappers/CI jobs often have 120s~300s timeouts and kill the process before summary.
• Failure mode is misleading as SIGKILL appears like system issue while root cause is audit throughput.

Requested improvements

1. Controlled parallelism for code-safety file scanning (worker pool / concurrency limit).
2. Incremental scan using mtime/hash cache persisted between runs.
3. Progress output during deep audit (collector start/end, files scanned, elapsed).
4. Per-collector timing breakdown in output/report for quick hotspot identification.
5. Configurable limits/timeouts per collector (not only global behavior).
6. Optional: --deep --only <collector> / split deep profile to make heavy checks schedulable.

Repro sketch

1. Install OpenClaw with many skill/plugin sources present.
2. Run:
   • openclaw security audit --deep
3. Observe long silent window; with caller timeout 120s this frequently ends as SIGKILL before report.

Additional note

I also checked latest stable 2026.5.7 package scanner bundle; this serial scan pattern and defaults appear unchanged, so issue likely still reproducible.