Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Meta Skill Optimizer
v1.0.0Self-improving AI skill optimizer that learns from feedback, auto-tunes prompts, optimizes tool usage patterns, and evolves based on success/failure analysis...
⭐ 0· 68·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md and meta_optimizer.py are broadly consistent: both describe learning from successes/failures, prompt optimization, pattern storage and recommending approaches. However, the SKILL.md suggests pip installing 'numpy scipy json' while the registry lists no install spec (registry and README disagree). Also the docs reference API/hooks (e.g., record_execution, optimize_skill) that do not appear as named methods in the shown code (code provides record_success/record_failure etc.), which is an incoherence between claimed API and implementation.
Instruction Scope
The README explicitly recommends 'Record Everything' and shows an after_execution hook to auto-record all executions and contexts. That means the skill is intended to capture arbitrary execution context and results across skills, which may include sensitive inputs and outputs. The instructions give broad discretion to collect and merge data ('Merge Insights', 'Export Knowledge'). The SKILL.md does not describe redaction, filtering, user consent, or privacy safeguards — scope creep from 'optimizer' to wide data collection is a significant privacy concern.
Install Mechanism
No formal install spec was provided in the registry (instruction-only), but SKILL.md includes a 'pip install numpy scipy json' line. That is inconsistent with the registry metadata. Installing 'json' via pip is unnecessary (stdlib json exists); requesting SciPy may be disproportionate if it's not used. Since there's no install script in the registry, dependency installation would be manual and should be audited.
Credentials
The skill declares no required environment variables or credentials, which matches the code snapshots. The optimizer saves its knowledge base under ~/.meta_optimizer/<skill>.json by default — local storage is proportional for a learning agent, but it means potentially sensitive execution data will be written to the user's home directory. There is no visible network or telemetry in the provided snippet, but SKILL.md references 'export' and 'merge' features; those could imply network I/O if implemented elsewhere — this should be checked before use.
Persistence & Privilege
always:false (default) so it is not force-included, which is appropriate. However the README encourages hooking into after_execution and 'optimize_skill(skill)', which would let the optimizer observe and modify other skills' behavior at runtime. That is powerful: it increases blast radius (it can influence many skills) even though it's not always-on. The code writes persistent files to the home directory which is expected for a knowledge base, but users should be aware of the persistent storage of recorded executions.
What to consider before installing
This skill roughly does what it says, but before installing consider the following: 1) The SKILL.md encourages auto-recording of all executions — that can capture private inputs/outputs. Ask whether you are comfortable with the optimizer storing that data on disk (default: ~/.meta_optimizer/<skill>.json) and whether redaction/consent is enforced. 2) There is a mismatch between the README and code: the README shows a hook 'record_execution' and 'optimize_skill' but the included code exposes record_success/record_failure and other methods. Ask the author or inspect the full meta_optimizer.py to confirm the actual API and any missing functions. 3) The README suggests 'pip install numpy scipy json' while the registry lists no install spec; 'json' is stdlib (pip install is unnecessary) and SciPy may be unnecessary — audit dependencies before running pip. 4) Search the full source for any network/telemetry/export code (functions named export/merge/send/post/requests/urllib/socket) before giving it access to real data. If you must try it: run in a sandboxed environment with non-sensitive data, review/modify code to add redaction or require explicit user confirmation before recording or exporting, and periodically inspect/clear ~/.meta_optimizer. If you want, I can: (a) scan the remaining truncated portion of meta_optimizer.py for network calls or export functions, (b) list exact lines where the README and code disagree, or (c) produce a minimal safe wrapper that forces redaction and disables automatic after_execution hooks.Like a lobster shell, security has layers — review code before you run it.
latestvk977pcq695mvd3gdk2n8y9gk5n83ceyf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.