T138 Imea Clawhub

• Risk level: Low
• Analyzed: Apr 4, 2026, 11:21 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill's files and runtime instructions are internally consistent with a local triple‑memory/checklist utility and do not request external credentials or network installs, though there are a few small mismatches and operational assumptions you should verify before enabling it in production.

Things to check before installing: 1) Verify your workspace layout — the script expects files like SESSION-STATE.md and .learnings/* and the script uses memory/*.md, while docs reference memory-l1-daily/ etc; adjust paths or directories so the script searches the intended files. 2) Review any memory files for sensitive secrets before granting a hook that will read them (the script only reads local files with grep, but those files may contain confidential data). 3) Understand behavior on no-match: the script exits non‑zero when no records are found, which could cause automated tasks to stop if you wire it into a before_action hook — test in a safe environment. 4) The 'agent-memory-certificate' and CEO/monitor enforcement language are documentation/policy, not code that reaches out to external services; confirm you are comfortable adopting that policy and that you control any actions that report to higher authorities. 5) Confirm the other referenced skills (proactive-agent, self-improvement, etc.) are trusted and available if you intend to use them. 6) Backup your agent config.json before adding hooks and run manual tests of scripts/memory-check.sh to ensure expected behavior.