Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
主动代理 Lite
v1.0.0Transform AI agents from task-followers into proactive partners with memory architecture, reverse prompting, and self-healing patterns. Lightweight version f...
⭐ 0· 56·0 current·1 all-time
by@jeayoo
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The description promises substantive capabilities (pre-compaction flush, long-term memory, self-healing, alignment systems) but the skill is instruction-only with no install steps, no declared storage or config, and no environment variables. There is no explanation for how persistent memory or automatic self-repair are implemented. Additionally, the registry ownerId differs from the _meta.json ownerId, which is an integrity inconsistency.
Instruction Scope
SKILL.md is high-level and vague: it tells the agent to 'automatically begin exhibiting proactive characteristics' without constraints or concrete rules. That grants wide operational discretion (what external calls to make, when to act, what data to store/transmit) but provides no safe-guarding instructions or limits. The instructions do not reference any paths, env vars, or APIs, so behavior is underspecified.
Install Mechanism
No install spec and no code files are present, so nothing will be written to disk or downloaded by the skill itself. This lowers immediate install-time risk.
Credentials
The skill requests no environment variables, credentials, or config paths (appropriate given no concrete implementation). However, the claimed features (long-term memory, self-healing) would typically require storage or external services; the absence of declared requirements is notable and makes the capability claims disproportionate to what is specified.
Persistence & Privilege
always:false and no special system config modifications are declared. The skill is user-invocable and can be invoked autonomously by agents by default (platform default) — that is expected but worth monitoring alongside the vagueness noted above.
What to consider before installing
This skill reads like marketing: it promises advanced persistent behaviors but provides no code, installs, or configuration details explaining how those behaviors are realized. Before installing: (1) prefer skills that declare how they implement persistence and what storage or permissions they need; (2) verify the maintainer and source (homepage absent and ownerId mismatch in metadata is a red flag); (3) test in a restricted/sandbox agent with no access to secrets or sensitive systems; (4) monitor logs and agent actions closely and start with conservative settings; (5) if you need persistent memory or self-healing, ask the maintainer for concrete implementation details (where data is stored, retention, privacy guarantees, and what external calls the skill will make). If the skill cannot explain those, treat it as untrusted for production use.Like a lobster shell, security has layers — review code before you run it.
latestvk97910dv1r33dtbzepzcm27ea183mczc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.