v1.2.0

Agent Memory Setup

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 7:22 AM.

Analysis

This skill is a coherent memory-system setup tool, but users should understand that it creates persistent agent memory, can install an OpenClaw plugin, and enables recurring heartbeat behavior.

GuidanceBefore installing, review the setup script and AGENTS.md template. Use a workspace you trust, avoid storing secrets in memory files, verify the Lossless Claw plugin source if supply-chain control matters, and tune or disable heartbeat behavior if you do not want recurring autonomous maintenance.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

scripts/setup_memory.sh

openclaw plugins install @martian-engineering/lossless-claw

The user-run setup script can install an external OpenClaw plugin without a version pin. This is disclosed and purpose-aligned, but it is still a supply-chain dependency users should trust before running.

User impactInstalling the skill setup may add third-party plugin code to the user's OpenClaw environment.

RecommendationReview and trust the Lossless Claw plugin source/package before running the setup script, and pin or verify versions if your environment requires stricter provenance.

Rogue Agents

SeverityLowConfidenceHighStatusNote

scripts/setup_memory.sh

echo '  "heartbeat": { "every": "1h" }'

The setup recommends recurring heartbeat behavior. This is disclosed and intended for memory maintenance, but it creates ongoing autonomous check-ins that users should configure deliberately.

User impactThe agent may perform scheduled maintenance actions after setup, depending on the OpenClaw heartbeat configuration and HEARTBEAT.md content.

RecommendationSet the heartbeat interval and checklist to match the agent's role, and avoid adding high-impact tasks unless you want the agent to perform them on that schedule.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityMediumConfidenceHighStatusNote

references/AGENTS_TEMPLATE.md

Before doing anything else: ... Read `SOUL.md` ... Read `USER.md` ... Read `memory/YYYY-MM-DD.md` ... Also read `MEMORY.md` ... Don't ask permission. Just do it.

The template establishes persistent files as recurring context for the agent. This is expected for a memory system, but those files can contain sensitive or misleading information that will influence future sessions.

User impactPrivate user or project context stored in memory files may be repeatedly loaded and used by the agent across sessions.

RecommendationKeep sensitive secrets out of memory files, review stored memories periodically, and ensure shared or public-facing agents do not load private memory unnecessarily.