limitless-lifelogs
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill is mostly aligned with searching Limitless life logs, but its agent-dispatch workflow can send sensitive transcript quotes to webhooks and has an inconsistent roster path that users should review before use.
Install only if you are comfortable giving the skill read access to your Limitless life logs. Before using action-item dispatch, correct the agents.json path mismatch, inspect the configured webhook URLs, and approve dispatches only when you intend to share the quoted transcript content with that external agent.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone using this skill is giving it access to private Limitless life-log transcripts through the API key.
The skill requires a Limitless API key to access the user's account data. This is expected for the stated purpose, but it is sensitive delegated account access.
Auth header: `X-API-Key: $LIMITLESS_API_KEY`
Use a dedicated Limitless API key if possible, keep it private, and revoke or rotate it if you stop using the skill.
A confirmed dispatch may share private life-log content outside Limitless/OpenClaw with whatever webhook is configured.
The skill can send exact transcript quotes, task summaries, log IDs, and timestamps to an agent webhook. Although it asks for confirmation, this creates a sensitive data boundary with another agent/service.
If the user says yes, read the agent's `dispatch` config from `agents.json` ... **webhook**: POST to `dispatch.url` with JSON body ... `"source_quote": "<exact quote>"`
Before dispatching, verify the webhook URL and agent identity, redact sensitive transcript text when possible, and only approve dispatches you intend to share externally.
The agent-dispatch feature could read the wrong configuration, making it unclear which agents or webhook destinations will be used.
SKILL.md tells the agent to load the roster from a `limitless` directory, while install.sh installs this skill and agents.json under `limitless_lifelogs`. That mismatch means the dispatch workflow may fail or use an unintended roster file.
cat ~/.openclaw/workspace/skills/limitless/agents.json | jq '[.agents[].name]'
Fix the roster path so SKILL.md and install.sh use the same directory, then review agents.json before enabling dispatch.