instant-genius

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A simple request could cause the agent to modify core OpenClaw behavior for future sessions.

Why it was flagged

A short phrase is recommended as enough for the agent to run setup and complete persistent configuration changes, rather than requiring step-by-step review of the resulting config edits.

Skill content
或者让 Agent 自动执行(推荐):直接说"一键变聪明",Agent 会自动完成所有配置。
Recommendation

Require the agent to show the exact files and diffs first, back up AGENTS.md/SOUL.md/HEARTBEAT.md, and ask explicit confirmation before applying changes.

What this means

Incorrect, sensitive, or stale notes could be reused across future conversations and change the agent's behavior until the user finds and edits them.

Why it was flagged

The skill makes memory files persistent and always loaded, while automatically adding corrections and preferences that can shape later tasks.

Skill content
读 `~/self-improving/memory.md`(HOT tier,永远加载) ... 明确用户纠正 → 立即追加到 `~/self-improving/corrections.md`
Recommendation

Review ~/self-improving and MEMORY.md regularly, keep sensitive information out of these files, and add clear retention, approval, and deletion rules.

What this means

The agent may become more autonomous and interruptive across future sessions, even though the artifacts include some cooldown rules.

Why it was flagged

The template installs ongoing proactive behavior that may cause the agent to initiate suggestions, discoveries, or exploration outside the immediate user request.

Skill content
不做等着被叫的工具。 ... 有发现就主动说 ... 每天想一个用户没想到但有用的建议 ... 定期去探索新领域
Recommendation

Only enable the proactive and heartbeat sections if desired, define allowed topics and quiet periods, and add a clear disable/uninstall procedure.

What this means

Users have less external provenance to rely on and should inspect the included files themselves before running setup.

Why it was flagged

The registry metadata lacks provenance and install-spec detail even though the artifact includes a shell setup script that changes local OpenClaw state.

Skill content
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill. Code file presence: scripts/setup.sh
Recommendation

Verify the owner/source if possible and review scripts/setup.sh and the template files before installation.