Back to skill
Skillv1.1.2
ClawScan security
Knowyourself · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 3, 2026, 4:04 AM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's instructions, file reads, and outputs align with its stated purpose (agent visual-identity discovery); it is instruction-only with no installers or unexpected credential requests, but it will read agent files and conversation history and expects image-generation tooling to be available in the agent environment.
- Guidance
- This skill appears to do what it says: it reads your agent's personality and recent conversation history, generates prompts, and uses available image-generation tools to produce and evaluate images, then saves a visual-identity.md. Before installing or running: (1) be aware it will read SOUL.md / MEMORY.md / IDENTITY.md and recent conversations — remove or redact sensitive content if you don't want it used; (2) confirm your agent environment has the image-generation integrations or API keys you intend to use (the skill does not request or validate credentials itself); (3) it will write identity files under ~/.openclaw/identity — review those files and outputs before publishing; (4) the skill may perform web searches as part of evaluation — if you restrict network access, the evaluation step will be limited; (5) run Quick Mode first to verify behavior and outputs before running the full multi-phase process. If you have strict data governance or external-service restrictions, test in a controlled environment first.
Review Dimensions
- Purpose & Capability
- okName/description match the behavior: the skill reads agent personality/memory files, derives a textual identity spec, and drives image generation/evaluation. Required inputs (SOUL.md, MEMORY.md, conversation history) and outputs (visual-identity.md, image files) are consistent with the stated goal.
- Instruction Scope
- noteInstructions explicitly tell the agent to read personality/memory files and recent conversation history (appropriate for self-reflection) and to perform web searches for trend research during evaluation. This is within scope for identity discovery but has privacy implications — the agent will access potentially sensitive conversation content and user data if present.
- Install Mechanism
- okInstruction-only skill with no install spec and no code files; nothing is written to disk by an installer. This minimizes installation risk. The skill does instruct writing its own visual-identity.md under ~/.openclaw/identity, which is expected and proportional.
- Credentials
- noteThe skill claims to work with any image generation tool but declares no required env vars or credentials. This is not necessarily malicious — it assumes the agent runtime already has whatever API keys or integrations are configured — but users should note that using external generators (DALL·E, Midjourney, Stable Diffusion services) typically requires credentials or service access which are not requested/validated by the skill.
- Persistence & Privilege
- okNo elevated privileges requested. always is false and the skill does not modify other skills or global agent settings. It will create or update its own identity files in the user's home directory, which is expected behavior.