Agent Os
PassAudited by ClawScan on May 1, 2026.
Overview
The skill is coherent and purpose-aligned, but users should understand that it stores persistent agent and project memory locally.
This appears safe to review as a local persistent project-coordination framework. Before installing, confirm the package/source you use matches these artifacts, and remember that project goals, task state, lessons, and outputs may be saved under the skill's data directory across sessions.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Project goals, task outputs, lessons, and agent state may remain on disk after the session and influence later use.
The agent loads and saves persistent memory files, so task history, lessons, and outputs can be reused across sessions.
this.memoryPath = path.join(__dirname, `../data/${id}-memory.json`); ... this.memory = this.loadMemory(); ... fs.writeFileSync(this.memoryPath, JSON.stringify(this.memory, null, 2), 'utf8');Avoid storing secrets or highly sensitive project details in goals, lessons, or outputs unless you are comfortable with them being saved locally; periodically review or delete the data directory if needed.
Users have less provenance information to confirm that an installed package or repository matches the reviewed artifacts.
The registry metadata does not provide a source repository or install specification, even though the documentation references installation and package-style usage.
Source: unknown; Homepage: none; Install specifications: No install spec — this is an instruction-only skill.
If using the npm, git, or ClawHub install examples, verify the package/repository identity and contents before relying on it.