Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Elephas
v2.3.0Long-term knowledge graph (Chronicle) maintenance. Ingests structured signals from system journals, resolves entity identity, promotes confirmed facts, and g...
⭐ 0· 154·0 current·0 all-time
byIndigo Karasu@indigokarasu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name/description (Chronicle writer/knowledge graph manager) aligns with its declared filesystem reads/writes (~/openclaw/journals/*, ~/openclaw/db/ocas-elephas) and the commands it exposes (ingest, consolidate, query, promote, merge). Access to other skills' journals and an embedded single-file DB is coherent with the stated purpose.
Instruction Scope
SKILL.md and references describe scanning all skill journals, reading intake files, writing an authoritative Chronicle DB, and creating Action Journals — all expected. However the README and headers also describe registering cron jobs (ingest/ deep/ update) and a self-update command that pulls from GitHub. Those behaviors modify system scheduling and fetch external code; they expand scope beyond pure data management and are not reflected as explicit install/runtime permissions in the registry metadata.
Install Mechanism
The registry shows no install spec, but SKILL.md header and README include an 'openclaw skill install https://github.com/indigokarasu/elephas' line and an `elephas.update` that pulls from GitHub. If an installer downloads/extracts code from GitHub and installs cron jobs, that is a higher‑risk install mechanism; the registry/manifest did not declare that install action explicitly.
Credentials
The skill requests no environment variables or external credentials, and the skill.json declares only filesystem read/write under ~/openclaw which matches its purpose. That said, it expects access to every skill's journal directory (~/openclaw/journals/*/) — necessary for its role but broad and capable of exposing other skills' outputs (potentially sensitive data).
Persistence & Privilege
always:false and default autonomous invocation are fine. But README claims the skill registers cron jobs (every 15 minutes, daily deep pass, nightly self-update). This produces persistent system‑level scheduling (runs outside explicit user invocation) and enables periodic self‑updates from GitHub — a privileged capability that increases blast radius if the source changes or is malicious. The registry did not surface this persistence behavior explicitly.
What to consider before installing
Elephas appears to do what it claims (ingest journals, reconcile identities, write a Chronicle DB), but there are a few things to check before installing:
- Cron and self‑update: The README says Elephas will register cron jobs (periodic ingest/consolidation and a nightly self-update from GitHub). Confirm whether the OpenClaw platform will perform these system changes on your behalf and whether you are comfortable with automated pulls from an external GitHub repo. Automatic self‑update + scheduled tasks is the biggest risk here.
- External code fetch: The SKILL.md/README reference installing from a GitHub URL. If you install, review the GitHub source first (or permit only vetted releases). An installer that downloads code is higher risk than an instruction‑only skill.
- Broad filesystem access: Elephas reads all other skill journals (~/openclaw/journals/*/). That is necessary for its consolidation role, but means it will process any sensitive data other skills emit. Make sure you trust the skill and the environment it runs in.
- Persistent writes: Elephas is the sole writer of Chronicle — it will modify ~/openclaw/db/ocas-elephas/chronicle.lbug. Back up important data before first run and consider running initial passes in observation (scan-only) mode if available.
- Mitigations to consider: restrict or review the install process; require manual approval for cron registration/self‑update; run first runs with read-only DB or in a sandbox; audit the GitHub repo for recent changes; limit filesystem permissions if your platform supports capability scoping.
If you want, I can: (a) list exact lines that declare cron/self-update and the install URL, (b) suggest safe install steps, or (c) draft a checklist to review the upstream GitHub source before allowing automatic updates.Like a lobster shell, security has layers — review code before you run it.
latestvk97d1stetytmkw6xxzhbjrss7d83rz6t
License
MIT-0
Free to use, modify, and redistribute. No attribution required.