ClawHub

OpenAuto - Autonomous Agent

v1.0.7

Proactive, self-improving agent architecture with hardened security. WAL Protocol, Working Buffer, Compaction Recovery, Autonomous Crons, and battle-tested p...

⭐ 1· 88·0 current·0 all-time
by@danavfrost
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (proactive, self-improving agent) matches what the skill does: it reads/writes agent identity, user context, memory, onboarding, tools, and heartbeat files and provides guidance for proactive behavior. No unrelated binaries or external credentials are requested.
ℹ
Instruction Scope
SKILL.md explicitly lists the workspace files the agent will read/write and limits automatic startup reads to SOUL.md, USER.md, and today's daily notes. That scope aligns with a proactive agent, but the guardrails are advisory (the doc notes they are not technically enforced), so correct behavior depends on the model following instructions. The skill also documents that .credentials/ and ~/.openclaw/openclaw.json are read only on request (e.g., when running the audit script).
✓
Install Mechanism
No install spec is present; the skill is instruction-first with a small included audit script. No downloads or external installers are used, which is the lowest-risk install profile.
✓
Credentials
The skill declares no required environment variables or primary credential. Files it reads/writes are workspace-local and documented. The only non-workspace path referenced (~/.openclaw/openclaw.json) is accessed only when running security-audit.sh, which is consistent with its stated auditing purpose.
✓
Persistence & Privilege
The skill is not force-installed (always: false). It does not request persistent platform privileges or attempt to modify other skills or system-wide settings. Autonomous invocation is allowed by default but not combined with other concerning privileges.
Assessment
This skill appears to be what it says: a proactive agent framework that stores and manages local workspace files and includes a benign security-audit script. Before installing: (1) don't place secrets (API keys, passwords) in USER.md, memory files, or other workspace files the agent will read; keep secrets in a properly permissioned .credentials/ directory and verify .gitignore. (2) Review assets/AGENTS.md, TOOLS.md and the security-audit.sh script yourself and only run the audit when you trust the environment (it will read ~/.openclaw/openclaw.json if present). (3) Remember the documented guardrails are advisory — the agent's compliance depends on the model; test in isolation and avoid storing highly sensitive data in the workspace until you're confident in behavior.

Like a lobster shell, security has layers — review code before you run it.

agentvk9707c29m4qg1j663bvc76wnx184khnzautomationvk9707c29m4qg1j663bvc76wnx184khnzideasvk9707c29m4qg1j663bvc76wnx184khnzlatestvk9707c29m4qg1j663bvc76wnx184khnzopenclawvk9707c29m4qg1j663bvc76wnx184khnzprocessingvk9707c29m4qg1j663bvc76wnx184khnzthinkingvk9707c29m4qg1j663bvc76wnx184khnz

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments