Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Agent Journal

v1.0.0

Give AI agents a persistent journal backed by BlueColumn semantic memory. Use when an agent should log daily observations, decisions, user preferences, or no...

0· 57·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for bluecolumnconsulting-lgtm/agent-journal.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Agent Journal" (bluecolumnconsulting-lgtm/agent-journal) from ClawHub.
Skill page: https://clawhub.ai/bluecolumnconsulting-lgtm/agent-journal
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install agent-journal

ClawHub CLI

Package manager switcher

npx clawhub@latest install agent-journal
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's stated purpose (persisting agent notes to BlueColumn) aligns with the HTTP endpoints documented in SKILL.md and references/api.md. However, the SKILL.md explicitly says a BlueColumn API key (bc_live_*) is required, yet the registry metadata lists no required environment variables or primary credential. That inconsistency means the skill's declared needs do not match what it actually requires to function.
Instruction Scope
Runtime instructions are narrowly scoped to three BlueColumn endpoints (/agent-note, /agent-remember, /agent-recall) — all expected for a journal. They do not instruct reading arbitrary local files or other secrets. However, the SKILL.md tells the agent to 'Read TOOLS.md for the BlueColumn API key' but no TOOLS.md is included in the package, which is ambiguous and could lead to ad-hoc secret prompting or misconfiguration.
Install Mechanism
This is instruction-only with no install spec and no code files, so nothing will be written to disk by an installer. That is the lowest-risk install model.
!
Credentials
The skill needs a sensitive credential (bc_live_* API key) to contact an external service, but the manifest does not declare any required env var or primary credential. That omission is disproportionate/unhelpful: users and the platform cannot see at install-time that a secret is required. Additionally, the skill will send user data to BlueColumn's Supabase backend (external network egress), which is proportionate to journaling but requires explicit user consent and a privacy review.
Persistence & Privilege
always is false (normal). The skill does not request elevated or persistent system privileges and does not claim to modify other skills or system settings.
What to consider before installing
Before installing, ask the author to correct the manifest so the BlueColumn API key is declared (e.g., add a required env var or primary credential) and to include or point to the missing TOOLS.md. Confirm the exact environment variable name the agent expects and how keys are stored/rotated. Verify you trust BlueColumn (review bluecolumn.ai privacy and data retention), since journal entries will be sent to a Supabase endpoint (https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1). If you proceed, avoid sending highly sensitive data, create a dedicated API key with minimal scope and rotation, and consider requiring explicit user invocation (disable autonomous invocation) or testing in a sandbox account first.

Like a lobster shell, security has layers — review code before you run it.

latestvk9743msqw0gmf7rb8mrkmkd87h84z9d2
57downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Agent Journal Skill

Persistent cross-session journal for AI agents. Store observations, preferences, and decisions — recall them anytime.

Setup

Read TOOLS.md for the BlueColumn API key (bc_live_*). Keys are generated at bluecolumn.ai/dashboard. Store securely — never log or expose them.

Base URL: https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1 (BlueColumn's official backend — bluecolumn.ai runs on Supabase Edge Functions)

Log an Observation (agent-note)

For lightweight agent observations — preferences, patterns, decisions:

curl -X POST .../agent-note \
  -H "Authorization: Bearer <key>" \
  -d '{"text": "User prefers bullet points over paragraphs", "tags": ["preference", "style"]}'

Log a Detailed Entry (agent-remember)

For richer entries with auto-extracted metadata:

curl -X POST .../agent-remember \
  -H "Authorization: Bearer <key>" \
  -d '{"text": "Session summary: user is building a SaaS product in Phoenix. Decided on PostgreSQL. Main concern is scalability.", "title": "Session Log 2026-04-14"}'

Recall Journal Entries

curl -X POST .../agent-recall \
  -H "Authorization: Bearer <key>" \
  -d '{"q": "what does the user prefer for formatting?"}'

When to Use Each

SituationEndpoint
Quick preference or observation/agent-note
End-of-session summary/agent-remember
Retrieving past context/agent-recall

Journaling Workflow

Start of session: Recall relevant context:

  • "What do I know about this user?"
  • "What were we working on last time?"

During session: Note important observations via /agent-note

End of session: Summarize and store via /agent-remember

Tag Suggestions

  • preference — user style/format preferences
  • decision — architectural or product decisions
  • context — background info about user/project
  • followup — things to revisit

See references/api.md for full API reference.

Comments

Loading comments...