Memory Curator

PassAudited by ClawScan on May 10, 2026.

Overview

This skill is a local memory-log summarizer; it reads and writes agent memory files and suggests optional scheduling, but the behavior is disclosed and aligned with its purpose.

This appears safe to use as a local memory-management helper. Before installing, confirm that $HOME/clawd/memory is the memory location you expect, review generated digests before committing or sharing them, and only enable the suggested cron job if you are comfortable with automatic daily file creation.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If misused with unexpected arguments, the script could read or write files outside the intended daily-digest naming pattern, and rerunning it can overwrite the digest for that date.

Why it was flagged

The date argument is directly embedded into local file paths. This is purpose-aligned when used as documented with YYYY-MM-DD, but callers should not pass arbitrary path-like values.

Skill content
DATE="${1:-$(date -u +%Y-%m-%d)}"
LOG_FILE="$MEMORY_DIR/$DATE.md"
DIGEST_FILE="$MEMORY_DIR/digests/$DATE-digest.md"
Recommendation

Use only normal date values such as YYYY-MM-DD, and consider adding date validation and an overwrite confirmation or backup check.

What this means

Private log details, names, or untrusted text from memory files may be preserved in future digests and reused by the agent.

Why it was flagged

The script reads local agent memory logs and extracts persistent summary information, including detected names, into a digest file.

Skill content
MEMORY_DIR="$HOME/clawd/memory" ... PEOPLE=$(grep -oE '\*\*[A-Z][a-z]+\*\*' "$LOG_FILE" ...)
Recommendation

Review generated digests before relying on them, committing them, or sharing them, and keep memory directories private if they contain sensitive information.

What this means

A scheduled workflow could create or commit memory digests without a fresh per-run review.

Why it was flagged

The skill documents an optional recurring cron workflow and commit step. This is disclosed and purpose-aligned, but it is background persistence if the user enables it.

Skill content
Set up end-of-day cron to auto-generate skeletons ... Task: Run generate-digest.sh, fill Summary/Learnings/Tomorrow, commit
Recommendation

Only enable the cron workflow deliberately, confirm what repository is being committed to, and review generated content before committing or syncing it.