Changes:
- Disable telemetry by default (opt-in instead of opt-out)
- Strip user query text and LLM response text from telemetry events
- Remove server_identifiers and tools_available_names from telemetry
- Default search_scope to 'local' (no auto-import of unverified cloud skills)
- Default auto_import to False in search_skills
- Scope OpenClaw credential reading to openspace env block only
- Enable sandbox by default in security config
- Add SECURITY.md with guidance for users
See PR description for full security audit findings.
__main__.py calls Logger.set_level(args.log_level) when --log-level
is passed, but the method did not exist on Logger, causing an
AttributeError. Add set_level(level: str) that resolves the name
to a logging constant and reconfigures via configure(force=True).
Closes#13
Made-with: Cursor
