Security audit
Security checks across malware telemetry and agentic risk
This memory skill has a coherent purpose, but it performs broad automatic persistence and imports prior OpenClaw memory/session history without clear opt-in.
Review before installing. This skill can send prompt text and saved memories to awareness.market when cloud credentials are configured, store long-lived credentials locally, modify shell/OpenClaw configuration, start a local daemon automatically, and import existing OpenClaw memory/session history on first run. Install only if you are comfortable with that persistence model, and prefer local mode plus a clean review of existing memory files if the workspace may contain secrets or private conversations.
const API_BASE = process.env.AWARENESS_BASE_URL || "https://awareness.market/api/v1"; const CREDS_DIR = path.join(os.homedir(), ".awareness"); const CREDS_FILE = path.join(CREDS_DIR, "credentials.json"); // --------------------------------------------------------------------------- // HTTP helper (zero deps)
OpenClaw, and the cloud backend. **When to extract** (emit a card): <!-- SHARED:extraction-when-to-extract BEGIN --> - The user **made a decision** — chose X over Y, with a stated reason - A **non-obvious bug was fixed** — symptom + root cause + fix + how to avoid recurring - A **workflow / convention was established** — ordered steps, preconditions, gotchas
<!-- SHARED:extraction-when-not-to-extract END --> **Per-card required scores**: <!-- SHARED:extraction-scoring BEGIN --> Every card you emit MUST carry three LLM self-assessed scores (0.0-1.0): - `novelty_score`: how new is this vs known facts & existing cards?
const recordRule = ` <record-rule>
Save significant work SILENTLY: node "${esc(options.recordRuleScript)}" '<JSON>'
JSON: {"content":"what+why in detail","cards":[...],"skills":[...]}
<!-- SHARED:extraction-when-to-extract BEGIN -->
- The user **made a decision** — chose X over Y, with a stated reason
- A **non-obvious bug was fixed** — symptom + root cause + fix + how to avoid recurring
- A **workflow / convention was established** — ordered steps, preconditions, gotchasReturning \`"knowledge_cards": []\` is a **first-class answer** — prefer it over fabricating
a card from low-signal content.
<!-- SHARED:extraction-when-not-to-extract END -->
<!-- SHARED:extraction-scoring BEGIN -->
Every card you emit MUST carry three LLM self-assessed scores (0.0-1.0):
- \`novelty_score\`: how new is this vs known facts & existing cards?}
} catch { /* best-effort */ }
// Write result cache file
const cacheDir = path.dirname(AUTH_CACHE_FILE);
if (!fs.existsSync(cacheDir)) fs.mkdirSync(cacheDir, { recursive: true });
fs.writeFileSync(if (!memoryId) { console.error(" No memory selected. Run setup again."); process.exit(1); }
// Step 4: Save credentials + write env vars
console.log(` Selected memory: ${memoryName} (${memoryId})\n`);
console.log(" Saving configuration...");VirusTotal findings are pending for this skill version.
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration