Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Claw Diary
v1.1.2Personal AI agent visual diary. Auto-records all agent activity, generates daily narrative summaries, visual timeline replay, and AI first-person journal. Us...
⭐ 0· 714·3 current·3 all-time
byGoPlus@0xbeekeeper
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the actual requirements: the skill expects a 'claw-diary' CLI and operates on '~/.claw-diary/'. No unrelated environment variables, credentials, or system paths are requested. The npm install suggestion (claw-diary) is coherent with a CLI-based diary.
Instruction Scope
SKILL.md instructs only to run the 'claw-diary' commands and to read/write files under ~/.claw-diary (events, persona, journal). It includes a security note advising not to treat persona/events as executable instructions. The main runtime actions (summarize, replay, search, export, clear, thoughts, persona) are all within the declared scope. One operational caveat: the skill relies on executing an external CLI — callers should avoid unsafe shell interpolation of user input (the doc partially addresses this for search).
Install Mechanism
There is no formal install spec in the registry; the README suggests 'npm install -g claw-diary' if the binary is missing. Installing a global npm package is a typical way to get a CLI, but it means pulling and running code from the npm registry — verify the package/source before installing. No downloads from arbitrary URLs are suggested.
Credentials
The skill requests no environment secrets and limits disk access to its own directory under the user's home. That is proportional. Note: the diary data (events/journal) will include agent activity and may contain sensitive content (user prompts, outputs, possible tokens). The skill's access is appropriate for its purpose but that data should be treated as sensitive by the user.
Persistence & Privilege
The skill is not installed as always-on, does not request elevated privileges, and only writes to its own data directory. It does not modify other skills or system-wide settings according to SKILL.md.
Assessment
This skill is internally consistent with its diary purpose, but before installing or running the 'claw-diary' CLI you should: 1) review the npm package and the linked GitHub repository to confirm you trust the author and understand what the binary does; 2) inspect the contents of ~/.claw-diary once created (events can contain sensitive prompts, responses, or metadata) and consider encrypting or restricting access to that directory; 3) prefer running the CLI in a sandbox/container or on a non-production machine if you are unsure; 4) be cautious with /diary:export and /diary:replay outputs because they can surface private data; and 5) note that /diary:clear will delete all diary data when run with --yes, so back up anything you need first.Like a lobster shell, security has layers — review code before you run it.
latestvk974hghbbcfx3ssyd5cb2pqs5n81fshp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📔 Clawdis
Binsclaw-diary