Agent Builder 1.0.0
PassAudited by ClawScan on May 1, 2026.
Overview
This instruction-only skill coherently helps build OpenClaw agent workspaces, but users should review generated autonomy, memory, and heartbeat settings and note the minor provenance mismatch.
This skill appears safe to use as an instruction-only generator. Before adopting its output, review the generated AGENTS.md, SOUL.md, MEMORY.md, and HEARTBEAT.md files, choose conservative autonomy unless needed, keep memory free of secrets, and verify the package publisher because the included metadata does not exactly match the registry summary.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The visible files do not show unsafe behavior, but the publisher/package identity is slightly inconsistent, so users may want to verify they are installing the intended skill.
The included _meta.json does not match the supplied registry summary's owner ID and slug, and the registry also lists source as unknown with no homepage. This is a provenance inconsistency, though the package is instruction-only.
"ownerId": "kn79fk2chsvyrdvmrnrj03yzhn7zynfp", "slug": "agent-builder"
Confirm the publisher and review the included files before installing or sharing generated agent workspaces.
If a user chooses broad autonomy, the generated agent may be more willing to act through tools or workflows in future sessions.
The skill can help create agents with varying autonomy, including an explicitly higher-risk autopilot mode. It also asks for prohibitions and includes ask-before-destructive/outbound-message guardrails, so this is disclosed and purpose-aligned.
**Autonomy level**: Advisor ... Operator ... Autopilot (broad autonomy; higher risk)
Prefer Advisor or Operator mode unless broad autonomy is truly needed, and keep explicit approval rules for destructive actions and outbound messages.
Information written into memory files may influence future agent behavior and could expose private context if copied into the wrong workspace or chat setting.
The skill can generate persistent memory files that future agents may read. The artifacts scope this to private sessions and include guidance not to store secrets, so the behavior is disclosed.
`MEMORY.md` (private sessions only) ... `memory/YYYY-MM-DD.md` seed
Keep memory files minimal, avoid secrets, and periodically review or delete stored memory entries.
If enabled, heartbeat behavior can cause an agent to perform periodic checks or continue light autonomous activity outside an immediate user prompt.
The references describe optional heartbeat behavior for future agents. The guidance recommends keeping heartbeat files tiny or empty and enabling them only after trust is established.
Heartbeats burn tokens; enable only once you trust the agent.
Leave HEARTBEAT.md empty by default and only add explicit, narrow checklist items when periodic behavior is desired.