Back to skill
Skillv1.0.0
ClawScan security
Project Retrospective · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 14, 2026, 4:15 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and instructions are coherent with its stated purpose: it analyzes conversation history, drafts a reusable skill document and a pitfalls (memory) file, and asks the user before saving; it does not request extra credentials or install anything.
- Guidance
- This skill analyzes completed conversations and writes two kinds of files into your agent workspace: a SKILL.md for a reusable skill and a pitfalls memory file. It does not request credentials or install software. Before installing, consider: (1) whether you want automatic triggers based on conversation length/turns — you may prefer explicit user initiation to avoid unexpected prompts; (2) review generated SKILL.md and memory files before they are used or shared (they can become reusable artifacts); (3) ensure workspace file permissions and backups are acceptable; (4) if you restrict autonomous agent actions, the skill's confirm-before-save step helps, but you may still want to keep it user-invocable only and not allow unattended autonomous invocation.
Review Dimensions
- Purpose & Capability
- okThe name/description (automatic project retrospective → generate a skill and record pitfalls) matches the instructions: detect long/complex conversations, extract steps/issues, and produce SKILL.md and memory files under the workspace. There are no unrelated env vars or binaries requested.
- Instruction Scope
- noteInstructions require reading the dialogue history and extracting project context, which is appropriate for the stated purpose. The skill will write files to /root/.openclaw/workspace/skills/<project-name>/SKILL.md and /root/.openclaw/workspace/memory/.... The SKILL.md specifies that the agent should ask the user to confirm before saving, which limits unilateral actions. One minor scope note: the trigger heuristics (2+ hours or 50+ messages, plus complexity conditions) could be broad and may produce prompts unexpectedly; consider whether you want automatic triggering or explicit user initiation only.
- Install Mechanism
- okInstruction-only skill with no install step and no code files. This is the lowest-risk install mechanism and matches the description.
- Credentials
- okNo environment variables, binaries, or external credentials are requested. The skill only reads conversation context and writes workspace files, which fits its purpose.
- Persistence & Privilege
- noteThe skill persists generated documents into the agent workspace (skills/ and memory/). Persisting new SKILL.md files can create reusable artifacts that might be later used by agents; however, the instructions include a user confirmation step before saving and do not instruct modifying other skills or global agent config. If you are concerned about persistent expansion of capabilities, review the generated files before enabling them or restrict autonomous behavior.