Self Improving Habit
Security checks across malware telemetry and agentic risk
Overview
The skill is mostly purpose-aligned and local, but its tracker script can write or append files outside the intended habit folder if given a crafted habit name.
Review before installing. The habit guidance itself is coherent and there is no evidence of network access or credential use, but do not use habit names containing slashes, '..', or unusual characters unless the script is fixed. Also review the referenced dependency if your OpenClaw setup loads dependencies automatically, and treat habit logs as private personal data.
VirusTotal
66/66 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A crafted or accidental habit name could create or append to files outside the habit tracker folder.
The script uses the habit name directly in the output path and writes/appends to that path. A name containing ../ could escape .learnings/habits and modify an unintended .md file.
HABIT_NAME="$1"
HABIT_FILE=".learnings/habits/${HABIT_NAME}.md"
...
cat > "$HABIT_FILE"
...
cat >> "$HABIT_FILE"Validate habit names before using them as paths, reject '/', '..', and control characters, and resolve the final path to ensure it remains under .learnings/habits before writing.
If the platform loads dependencies automatically, additional behavior may come from a separate skill not reviewed in these artifacts.
The metadata declares an additional dependency, while the install section says there is no install spec. The provided artifacts do not show that dependency's contents.
"dependencies": ["self-improving-agent"], "partOfSuite": "self-improving-suite"
Review the referenced dependency before enabling the suite, especially if the platform installs or invokes dependencies automatically.
Habit logs may reveal private routines, struggles, schedules, or health/productivity patterns if the files are shared or later reused by an agent.
The skill intentionally stores habit definitions and daily logs in persistent local files, including details such as completion, willpower, challenges, and personal patterns.
Append to `.learnings/habits/HABIT_NAME.md` ... Append to `.learnings/habits/HABIT_NAME_LOGS.md`
Keep the .learnings/habits folder private, avoid recording highly sensitive details, and periodically review or delete old logs.