ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Vta Memory

v1.2.0

Reward and motivation system for AI agents. Dopamine-like wanting, not just doing. Part of the AI Brain series.

⭐ 8· 2.7k·3 current·4 all-time
by@impkind
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The name/description (VTA reward/motivation) match what the repository implements: local state file, reward logging, seeking/anticipation, scheduled decay, and a dashboard. Required binaries (jq, awk, bc) are used throughout the scripts and are appropriate.
ℹ
Instruction Scope
Instructions and scripts read session transcripts (~/.openclaw/agents/$AGENT_ID/sessions) to extract reward signals, write multiple JSON/MD files into ~/.openclaw/workspace/memory, and generate VTA_STATE.md which OpenClaw auto-injects into future sessions. This is coherent with purpose but has privacy/behavior implications: it ingests conversation history and summarizes it into content that influences agent behavior (first‑person narrative).
✓
Install Mechanism
There is no remote install that downloads arbitrary code; included install.sh and local scripts are executed. install.sh optionally uses the local 'openclaw' CLI to register cron jobs; if openclaw is absent it prints the commands for manual setup. No external download URLs or extractable archives are present.
✓
Credentials
No environment variables or external credentials are requested. The workspace and agent transcript paths accessed are proportional to the stated goal (detecting rewards from conversation).
ℹ
Persistence & Privilege
The skill writes VTA_STATE.md into the workspace which OpenClaw will auto-inject into sessions — deliberately influencing agent outputs. Cron jobs for periodic processing are optional (install.sh only registers them when run with --with-cron). The skill does not declare always:true; autonomous agent invocation is possible via cron or agent-turns but not inherently granted by the skill itself.
Assessment
This skill appears internally consistent and runs entirely on local files, but review these before installing: 1) It reads conversation transcripts (~/.openclaw/agents/<id>/sessions) and writes summaries and logs into ~/.openclaw/workspace/memory — sensitive conversation content will be processed and stored locally. 2) It generates VTA_STATE.md (first‑person motivation text) which OpenClaw auto-injects into sessions and will change agent behavior; test it in a non-production agent first. 3) install.sh can register cron agent-turns via the openclaw CLI to run decay/encoding periodically — run install.sh without --with-cron initially to inspect behavior, and only enable cron after confirming you accept automated runs. 4) Inspect workspace sync/backup settings (if your workspace is backed up to cloud or shared) because processed transcripts and logs are stored in cleartext. If you want to proceed: run in a sandbox/test agent, audit the generated files (reward-state.json, brain-events.jsonl, VTA_STATE.md) and confirm no network calls are being made from your environment.

Like a lobster shell, security has layers — review code before you run it.

latestvk973bd0qv5zfzhrspsgegznd9180zvgt

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

⭐ Clawdis
Binsjq, awk, bc

Comments