Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Agent Autonomy Primitives

v1.0.0

Build long-running autonomous agent loops using ClawVault primitives (tasks, projects, memory types, templates, heartbeats). Use when setting up agent autono...

0· 1.2k·9 current·9 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for g9pedro/agent-autonomy-primitives.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Agent Autonomy Primitives" (g9pedro/agent-autonomy-primitives) from ClawHub.
Skill page: https://clawhub.ai/g9pedro/agent-autonomy-primitives
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install agent-autonomy-primitives

ClawHub CLI

Package manager switcher

npx clawhub@latest install agent-autonomy-primitives
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md requires installing and using the clawvault CLI (npm install -g clawvault, clawvault init) and references CLAWVAULT_* environment variables, but the registry metadata lists no required binaries or env vars. That mismatch indicates the declared requirements do not match what the skill actually needs.
!
Instruction Scope
Instructions tell an agent to list tasks, pick the highest-impact task, and then 'Execute it' during each heartbeat. 'Execute it' is intentionally vague and grants the agent broad discretion to run arbitrary work (which could include network calls, subprocesses, filesystem changes). The adaptation guide also shows example code that runs subprocesses with the agent's full environment, increasing the scope of actions an agent might take.
Install Mechanism
There is no formal install specification in the registry (skill is instruction-only), but the SKILL.md asks the user to run npm install -g clawvault. Relying on an npm global install is moderately risky unless the package source is known and trusted; the skill metadata does not provide a homepage or package origin to verify.
!
Credentials
SKILL.md documents environment variables (CLAWVAULT_PATH, CLAWVAULT_COMPRESSION_PROVIDER, CLAWVAULT_COMPRESSION_MODEL) and instructs merging os.environ when invoking the CLI, but the skill's declared required env vars are empty. The described behavior would allow the agent to read and rely on environment settings not declared in the registry, which is a proportionality/visibility problem.
Persistence & Privilege
The skill is not marked always:true and is user-invocable (normal). However the docs mention 'OpenClaw hooks (in skills/clawvault/hooks/) auto-checkpoint' which suggests the clawvault installation or usage may create hooks or files under an agent's skills tree. That could modify agent-side files; users should verify whether installing clawvault will write into agent or system skill directories.
What to consider before installing
This skill appears to implement what it claims (a file-based 'ClawVault' workflow and heartbeat-driven autonomy), but the package metadata and the runtime instructions are inconsistent and the heartbeat step gives agents open-ended authority to 'execute' tasks. Before installing or enabling this skill: 1) Verify the source of the clawvault npm package (official repo/organization, code review) rather than running a global install blindly. 2) Expect to install Node/npm and the clawvault CLI—these are required even though the registry metadata doesn't list them. 3) Be cautious about allowing your agent to 'execute' task steps autonomously; restrict the agent's runtime permissions (network, filesystem, credential access) or test in an isolated environment first. 4) Confirm what files the clawvault tool will write (hooks, skills/* paths, checkpoints) and whether it will modify agent configuration. 5) Limit or review environment variables (CLAWVAULT_PATH, compression provider/model settings) to avoid exposing sensitive credentials. If the publisher/ homepage and the clawvault package repository are provided and you can inspect the package source and confirm the install behavior, the concerns here would be substantially reduced.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bd4mm6mkgrchfnqfaxc43yx818n2f
1.2kdownloads
0stars
1versions
Updated 12h ago
v1.0.0
MIT-0

Agent Autonomy Primitives

Turn any AI agent into a self-directing worker using five composable primitives: typed memory, task files, project grouping, template schemas, and heartbeat loops.

Prerequisites

npm install -g clawvault
clawvault init

The Five Primitives

1. Typed Memory

Every memory has a type. The type determines where it lives and how it's retrieved.

TypeDirectoryWhen to Use
decisiondecisions/Recording a choice with rationale
lessonlessons/Something learned from experience
personpeople/Contact info, relationship context
commitmentcommitments/Promise made, deliverable owed
preferencepreferences/How someone likes things done
factinbox/Raw information to file later
projectprojects/Workstream with goals and status

Store with type:

clawvault remember decision "Chose Resend over SendGrid" --content "Lower cost, better DX, webhook support"
clawvault remember lesson "LLMs rewrite keywords during compression" --content "Always post-process with regex"

Rule: If you know WHAT KIND of thing it is, use the right command. Dumping everything into daily notes defeats retrieval later.

2. Task Primitives

A task is a markdown file with YAML frontmatter in tasks/:

---
status: open
priority: high
owner: your-agent-name
project: my-project
due: 2026-03-01
tags: [infrastructure, deploy]
estimate: 2h
---
# Deploy API to production

## Context
Server provisioned. Need Dockerfile fix.

## Next Steps
- Fix binding to 0.0.0.0
- Add health endpoint
- Push and verify

Create tasks:

clawvault task add "Deploy API to production" \
  --priority high \
  --owner my-agent \
  --project my-project \
  --due 2026-03-01 \
  --tags "infrastructure,deploy"

Update status:

clawvault task update deploy-api-to-production --status in-progress
clawvault task done deploy-api-to-production --reason "Deployed, health check passing"

Statuses: openin-progressdone (or blocked) Priorities: critical > high > medium > low

3. Project Grouping

Projects group related tasks with metadata:

clawvault project add "Outbound Engine" \
  --owner pedro \
  --client versatly \
  --tags "gtm,sales" \
  --deadline 2026-03-15

Tasks reference projects via the project field. Filter tasks by project:

clawvault task list --project outbound-engine

4. Template Schemas

Templates are YAML schema definitions that control what fields exist on every primitive. They live in templates/ in your vault.

See references/template-customization.md for full customization guide.

Key points:

  • Vault templates override builtins — drop a task.md in templates/ to change the schema
  • Add fields (e.g., sprint, effort, client) by editing the template
  • Remove fields you don't need
  • Change defaults (e.g., default priority = high)
  • Validation is advisory — warns but never blocks

5. Heartbeat Loop

The heartbeat is the autonomy mechanism. Wire it into your agent's periodic wake cycle.

Every heartbeat (e.g., every 30 minutes):

1. clawvault task list --owner <agent-name> --status open
2. Sort by: priority (critical first), then due date (soonest first)
3. Pick the highest-impact task executable RIGHT NOW
4. Execute it
5. On completion: clawvault task done <slug> --reason "what was done"
6. On blocker: clawvault task update <slug> --status blocked --blocked-by "reason"
7. If new work discovered: clawvault task add "new task" --priority <p> --project <proj>
8. If lesson learned: clawvault remember lesson "what happened"
9. Go back to sleep

Implementation for OpenClaw agents:

Add to your HEARTBEAT.md:

## Task-Driven Autonomy

Every heartbeat:
1. `clawvault task list --owner <your-name> --status open` → your work queue
2. Sort by priority + due date
3. Pick highest-impact task you can execute NOW
4. Work it. Update status. Mark done. Report.
5. Check for tasks due within 24h — those get priority

For cron-based agents, schedule a recurring job:

Schedule: every 30 minutes
Action: Read task queue, pick highest priority, execute, report

Composing Primitives into Autonomy

The power is in composition, not any single primitive:

Wake → Read memory → Check tasks → Execute → Learn → Update memory → Sleep
         ↑                                      |
         └──────────────────────────────────────┘

Each cycle compounds:

  • Memory feeds context into task execution (decisions, lessons, preferences inform how work gets done)
  • Task execution generates new memories (lessons learned, decisions made, commitments created)
  • Lessons improve future execution (mistakes aren't repeated)
  • Wiki-links ([[entity-name]]) build a knowledge graph across all files
  • Projects provide scope boundaries so the agent doesn't drift

Adapting to Your Setup

See references/adaptation-guide.md for detailed patterns on:

  • Wiring primitives into existing agent frameworks (OpenClaw, LangChain, CrewAI, custom)
  • Choosing which primitives to adopt (start minimal, add as needed)
  • Multi-agent collaboration through shared vaults
  • Migrating from other memory systems

Quick Start: Zero to Autonomous in 5 Minutes

# 1. Install and init
npm install -g clawvault
clawvault init

# 2. Create your first project
clawvault project add "My Project" --owner my-agent

# 3. Create tasks
clawvault task add "Set up monitoring" --priority high --owner my-agent --project my-project
clawvault task add "Write API docs" --priority medium --owner my-agent --project my-project

# 4. Wire into heartbeat (add to HEARTBEAT.md or cron)
# "Every 30min: clawvault task list --owner my-agent --status open, pick top task, execute"

# 5. Start working
clawvault task update set-up-monitoring --status in-progress
# ... do the work ...
clawvault task done set-up-monitoring --reason "Prometheus + Grafana configured"
clawvault remember lesson "UptimeRobot free tier only checks every 5min" --content "Use Better Stack for <1min checks"

Anti-Patterns

Don'tDo Instead
Store everything in one big memory fileUse typed memory — decisions/, lessons/, people/
Create tasks without owner/projectAlways set --owner and --project
Ask "what should I work on?"Read your task queue and decide
Forget lessons after learning themclawvault remember lesson immediately
Skip marking tasks doneAlways task done --reason — the ledger tracks transitions
Create tasks for vague ideasPut ideas in backlog/, promote to tasks/ when ready
Modify template schemas constantlyStabilize schemas early — field renames break existing files

Obsidian Integration

Because everything is markdown + YAML frontmatter, Obsidian renders your agent's workspace as a human-readable dashboard:

  • Kanban board — open all-tasks.base in Obsidian Bases, drag between status columns
  • Blocked viewblocked.base shows what needs human input
  • By ownerby-owner.base shows what each agent is working on
  • By projectby-project.base scopes views per workstream

The same file is both the agent's data structure AND the human's UI. No sync layer needed.

Comments

Loading comments...