Skill flagged โ€” suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Mulch

v1.0.5

Mulch Self Improver โ€” Let your agents grow ๐ŸŒฑ. Captures learnings with Mulch so expertise compounds across sessions. Use when: command/tool fails, user corre...

โญ 0ยท 647ยท4 currentยท4 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report โ†’
OpenClawOpenClaw
Benign
high confidence
โœ“
Purpose & Capability
The skill's name/description (a self-improvement layer that records learnings with Mulch) matches the code and docs: it adds a bootstrap reminder, suggests running `mulch prime`/`mulch record`, and ships provider hooks and helper scripts. Declared capabilities (domains, search, recording) align with the included CLI usage and hook handlers.
โœ“
Instruction Scope
SKILL.md and the OpenClaw hook limit behavior to adding a virtual reminder file at bootstrap, suggesting `mulch` CLI commands, and prompting users to record learnings. The runtime instructions operate on local repo state (.mulch/) and do not direct the agent to read unrelated system files, environment secrets, or to contact unexpected external endpoints.
โœ“
Install Mechanism
There is no install spec (instruction-only skill for the platform), so nothing is downloaded or installed automatically. The README recommends installing the public mulch-cli via npm or using npx, which is proportional to the stated purpose. Included scripts and tests are local to the skill repository.
โ„น
Credentials
The skill declares no required env vars or credentials (appropriate for a local CLI/helper). However, config/domains.json and multiple docs mention notifications via Telegram (notifications.enabled: true and 'You'll be notified via Telegram') even though no Telegram token/chat-id env var is declared or used in the hook code (notifyUser is a stub that does not perform network calls). This is a mismatch to be aware of: notifications are advertised but there is no built-in credential/config wiring in the shipped code.
โœ“
Persistence & Privilege
The skill does not request always:true and does not modify other skills' configurations. The OpenClaw hook injects virtual files at bootstrap (SELF_IMPROVEMENT_REMINDER.md, MULCH_PRESET_DOMAINS.md) which is expected behavior for a reminder hook. Autonomous invocation of the hook on bootstrap is the normal platform pattern.
Assessment
This skill appears to do what it says: it provides a local, git-tracked 'Mulch' workflow and an OpenClaw hook that injects a short reminder and suggests using the mulch CLI. Before installing or running any provided scripts, review the repository's scripts (activator.sh, error-detector.sh, extract-skill.sh and the docker-test scripts) in a sandbox or CI environment to confirm they behave as expected. Note two small mismatches to verify: (1) the project claims Telegram notifications but the code does not include an implemented integration or require Telegram credentials โ€” if you enable notifications you should verify where/how credentials are configured; (2) small metadata inconsistencies (owner/slug differences in _meta.json vs registry metadata) likely indicate packaging/versioning noise but you may want to confirm the source/repository identity before trusting automated runs. If you plan to run the included Docker test or any scripts, run them in an isolated environment (container) and inspect the output before granting broader access.

Like a lobster shell, security has layers โ€” review code before you run it.

latestvk97fnjsvt4xy7tq7cerwgdpqfs81tz36
647downloads
0stars
6versions
Updated 8h ago
v1.0.5
MIT-0

Mulch Self Improver โ€” Let your agents grow ๐ŸŒฑ

Structured expertise that accumulates over time, lives in git, and works with any agent. Agents start each session from zero; the pattern discovered yesterday is forgotten today. This skill uses Mulch: agents call mulch record to write learnings and mulch query to read them. Expertise compounds across sessions, domains, and teammates. Mulch is a passive layer โ€” it does not contain an LLM. Agents use Mulch; Mulch does not use agents.

Benefits: Better and more consistent coding ยท Improved experience ยท Less hallucination (grounding in project expertise)

When to use: Command/tool fails, user corrects you, user wants a missing feature, your knowledge was wrong, or you found a better approach โ€” record with Mulch and promote proven patterns to project memory. Auto-detection: The hook now detects errors and corrections automatically and prompts to record.

Mechanics: One learning store โ€” .mulch/ (append-only JSONL, git-tracked, queryable). Session start: mulch prime. Recording: mulch record <domain> --type <type> .... No .learnings/ markdown files.

Qualification (features, benefits, pain points): See QUALIFICATION.md. Benchmark (token efficiency, troubleshooting skill improvement): See BENCHMARK.md โ€” e.g. ~54% fewer chars to get same resolutions; find rate same or better; less context โ†’ fewer tokens, less noise, lower risk of wrong fix.

New Features (v1.1)

Auto-Detection

The hook now automatically detects learning moments:

  • Errors/failures โ€” When commands fail or return errors
  • Corrections โ€” When you say "no", "actually", "wrong", etc.
  • Retries โ€” When you ask to try again

The agent will prompt: "Want me to record this for next time?"

Pre-loaded Domains

24 preset domains included in config/domains.json:

api, database, testing, frontend, backend, infra, docs, config,
security, performance, deployment, auth, errors, debugging,
workflow, customer, system, marketing, sales, content,
competitors, crypto, automation, openclaw

Notifications

When a learning is recorded, you're notified via Telegram.


Quick Reference

SituationAction
Command/operation or API failsmulch record <domain> --type failure --description "..." --resolution "..."
User corrects you / knowledge was wrongmulch record <domain> --type convention "..." or --type pattern --name "..." --description "..."
Found better approach, best practicemulch record <domain> --type convention "..." or --type guide --name "..." --description "..."
Architectural or tech decisionmulch record <domain> --type decision --title "..." --rationale "..."
Feature request (tracking)mulch record <domain> --type decision --title "..." --rationale "..."
Key file/endpoint to remembermulch record <domain> --type reference --name "..." --description "..."
Similar to existing recordUse --relates-to <domain>:<id> or --supersedes; run mulch search "..." first
Broadly applicable patternPromote to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md; use mulch onboard for snippets
Session start (project has .mulch/)Run mulch prime to load expertise into context

Mulch Setup

Install (optional; npx works without install):

npm install -g mulch-cli
# or: npx mulch-cli <command>

Initialize in project:

mulch init
# Quick: add all preset domains at once
cat config/domains.json | jq -r '.domains[].name' | xargs -I {} mulch add {}
# Or add individually:
mulch add api
mulch add database
mulch add testing
# add domains that match your areas: frontend, backend, infra, docs, config

Provider hooks (remind agent to record):

mulch setup cursor   # or: claude, codex, gemini, windsurf, aider

Onboarding snippet for AGENTS.md/CLAUDE.md:

mulch onboard

Record Types (Mulch)

TypeRequiredUse Case
failuredescription, resolutionWhat went wrong and how to avoid it
conventioncontent"Use pnpm not npm"; "Always WAL mode for SQLite"
patternname, descriptionNamed patterns, optional --file
decisiontitle, rationaleArchitecture, tech choices, feature tracking
referencename, descriptionKey files, endpoints, resources
guidename, descriptionStep-by-step procedures

Optional on any record: --classification (foundational | tactical | observational), --tags, --relates-to, --supersedes, --evidence-commit, --evidence-file, --outcome-status (success | failure).

Workflow

  1. Session start: If .mulch/ exists, run mulch prime (or mulch prime <domain> for focus).
  2. During work: When something fails or you learn something, run mulch record <domain> --type <type> ....
  3. Before finishing: Review; record any remaining insights with mulch record.
  4. Promote: When a pattern is proven and broadly applicable, add to CLAUDE.md / AGENTS.md / SOUL.md / TOOLS.md; use mulch onboard to generate snippets.

Finding Domain

  • Use existing domains from mulch status or mulch query --all.
  • Run mulch learn to get domain suggestions from changed files.
  • Common domains: api, database, testing, frontend, backend, infra, docs, config.

Recurring Patterns and Linking

  • Search first: mulch search "keyword" or mulch query <domain>.
  • Link records: mulch record ... --relates-to <domain>:<id> or --supersedes <domain>:<id>.
  • Recurring issues โ†’ promote to CLAUDE.md/AGENTS.md or add to TOOLS.md/SOUL.md so all agents see them.

Simplify & Harden Feed

For candidates from the simplify-and-harden skill:

  1. Use pattern_key as a stable tag: mulch record <domain> --type pattern --name "<pattern_key>" --description "..." --tags "simplify-and-harden".
  2. Search first: mulch search "<pattern_key>"; if found, use --relates-to or add to existing via mulch edit if needed.
  3. When recurrence is high, promote to CLAUDE.md/AGENTS.md/SOUL.md/TOOLS.md as short prevention rules.

Periodic Review

  • When: Before major tasks, after features, weekly.
  • Commands: mulch status, mulch ready --since 7d, mulch query --all.
  • Actions: Promote high-value records to project memory; run mulch prune for stale tactical/observational entries if desired; mulch doctor --fix for health.

Promotion Targets

Learning TypePromote To
Behavioral patternsSOUL.md (OpenClaw workspace)
Workflow improvementsAGENTS.md
Tool gotchasTOOLS.md (OpenClaw workspace)
Project facts, conventionsCLAUDE.md
Copilot context.github/copilot-instructions.md

Use mulch onboard to generate AGENTS.md/CLAUDE.md snippets.

Detection Triggers

Record when you notice:

  • User corrects you ("No, that's not right...", "Actually...") โ†’ convention or pattern
  • Command/API/tool fails โ†’ failure (description + resolution)
  • User wants missing capability โ†’ decision (title + rationale)
  • Your knowledge was wrong or outdated โ†’ convention
  • You found a better approach โ†’ convention or guide

OpenClaw Setup

OpenClaw injects workspace files; use Mulch for learnings.

Installation

clawdhub install self-improving-agent
# or: git clone ... ~/.openclaw/skills/self-improving-agent

Workspace and Mulch

  • Session start: Run mulch prime when the project (or workspace) has .mulch/. Optionally add mulch prime output to workspace context if your setup supports it.
  • Recording: Use mulch record from the project or workspace directory that contains .mulch/.
  • Promotion: SOUL.md, AGENTS.md, TOOLS.md live in ~/.openclaw/workspace/; add promoted rules there.

Enable Hook (reminder at bootstrap)

cp -r hooks/openclaw ~/.openclaw/hooks/self-improvement
openclaw hooks enable self-improvement

See references/openclaw-integration.md.

Generic Setup (Other Agents)

  1. In project: mulch init and mulch add <domain> as needed.
  2. Use mulch setup <provider> (cursor, claude, codex, etc.) for hooks.
  3. Add to CLAUDE.md/AGENTS.md: "Run mulch prime at session start. Record learnings with mulch record <domain> --type failure|convention|decision|pattern|guide|reference."
  4. Run mulch onboard and paste the snippet into your agent docs.

Multi-Agent Safety

Mulch is safe for concurrent use: advisory file locking, atomic writes, and merge=union in .gitattributes for JSONL. Multiple agents can run mulch prime and mulch record in parallel; locks serialize writes per domain.

Skill Extraction

When a Mulch record is valuable as a reusable skill:

  1. Get content from mulch query <domain> or mulch search "...".
  2. Create skills/<skill-name>/SKILL.md (template in assets/SKILL-TEMPLATE.md).
  3. Optionally note in the record (e.g. via mulch edit) that it was promoted to a skill.

Best Practices

  1. Record immediately โ€” context is freshest after the issue.
  2. Pick the right type โ€” failure (description+resolution), convention (short rule), decision (title+rationale), etc.
  3. Use domains consistently โ€” e.g. same api domain for all API-related learnings.
  4. Link related records โ€” --relates-to, --supersedes.
  5. Run mulch prime at session start โ€” so the agent is grounded in existing expertise.
  6. Promote when proven โ€” move broadly applicable rules to CLAUDE.md, AGENTS.md, SOUL.md, TOOLS.md.

No .learnings/

This skill does not use .learnings/ or markdown log files. All learnings live in .mulch/ and are recorded via the Mulch CLI. If you see references to .learnings/ in older docs, treat them as superseded by Mulch.

Comments

Loading comments...