Security audit
Self Improving Habit
Security checks across malware telemetry and agentic risk
Overview
The skill is mostly purpose-aligned and local, but its tracker script can write or append files outside the intended habit folder if given a crafted habit name.
Review before installing. The habit guidance itself is coherent and there is no evidence of network access or credential use, but do not use habit names containing slashes, '..', or unusual characters unless the script is fixed. Also review the referenced dependency if your OpenClaw setup loads dependencies automatically, and treat habit logs as private personal data.
VirusTotal
66/66 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.