Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Nm Conserve Clear Context
v1.0.0Automatic context management with graceful handoff to a continuation subagent at 80% usage
⭐ 0· 40·1 current·1 all-time
by@athola
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (automatic context management and handoff) align with the SKILL.md: it saves a session-state file, spawns a continuation subagent, and instructs how to continue. There are no unexpected credential requests or unrelated binaries.
Instruction Scope
Runtime instructions tell the agent to read and write .claude/session-state.md (or a configured path), read existing session state first, consult git/PRs, and spawn continuation agents using the Task tool. The docs also allow the agent to "make reasonable assumptions" and to continue work automatically when execution_mode.auto_continue is true. That grants broad discretion and can lead to unattended actions; the instructions are somewhat open-ended and encourage non-interactive continuation when 'dangerous'/'unattended' mode is detected.
Install Mechanism
Instruction-only skill with no install spec and no code files. Nothing will be downloaded or written to disk by an installer; the only file writes are the session-state files the agent is instructed to create at runtime.
Credentials
The skill's registry metadata declares no required env vars, but SKILL.md references several environment variables (CONSERVE_EMERGENCY_THRESHOLD, CONSERVE_SESSION_STATE_PATH, CLAUDE_DANGEROUS_MODE, CLAUDE_UNATTENDED). That mismatch means required configuration isn't surfaced by the registry. Also, execution depends on CLAUDE_DANGEROUS_MODE / CLAUDE_UNATTENDED which, when set, cause continuation agents to auto-run without confirmation—this is powerful and potentially dangerous. Writing session-state files can also accidentally persist sensitive data if not managed carefully; the doc asks not to include secrets but cannot enforce it.
Persistence & Privilege
The skill does not request permanent installation or 'always: true'. However, it instructs creating and reading a project-scoped state file and delegating work to continuation agents. If continuation agents honor auto_continue/dangerous flags, they may perform unobstructed actions across handoffs — consider that risk when enabling unattended/dangerous modes.
What to consider before installing
This skill is coherent with its stated goal, but review before use: 1) The SKILL.md references environment variables (CONSERVE_* and CLAUDE_*) although the registry lists none — set and audit those intentionally. 2) The skill writes .claude/session-state.md (or a custom path); ensure your workflows do not cause secrets or credentials to be written to that file or a world-readable location. 3) Beware of 'dangerous' / 'unattended' modes: if CLAUDE_DANGEROUS_MODE or CLAUDE_UNATTENDED is set, continuation agents may proceed without user confirmation — test on non-sensitive projects and prefer interactive mode. 4) Confirm how your platform's Task/TaskUpdate/TaskCreate tools work and what permissions continuation agents receive. 5) If you accept the skill, consider restricting the session state path to a safe location (e.g., project-local, not /tmp or home) and audit generated files after handoffs. If you want greater assurance, ask the maintainer to update registry metadata to declare the env vars the skill actually reads and to add explicit guidance to avoid persisting secrets.Like a lobster shell, security has layers — review code before you run it.
latestvk97dzhghssja5mkvf54jx7wqqh84mewd
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🦞 Clawdis