Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Self Improvement Loop

v4.6.13

Per-agent feedback loop for OpenClaw — captures corrections/errors/features, detects patterns per agent workspace, notifies via per-agent channel bot, and ex...

0· 309·1 current·1 all-time
byjichangtuijian@jichangtuijie

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for jichangtuijie/self-improvement-loop.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Self Improvement Loop" (jichangtuijie/self-improvement-loop) from ClawHub.
Skill page: https://clawhub.ai/jichangtuijie/self-improvement-loop
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install self-improvement-loop

ClawHub CLI

Package manager switcher

npx clawhub@latest install self-improvement-loop
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (per-agent feedback loop, detect patterns, notify, act on A/B/C/D) aligns with the files and scripts provided. The installer and cron logic legitimately need to read openclaw.json, per-agent workspaces, and send notifications, and the skill installs helper components (skill-creator, skill-improvement) that are required to implement A/B actions. Note: the installer also writes bindings to openclaw.json and injects content into agent AGENTS.md/memory.md which is beyond the skill's own directory but consistent with its routing/notification goals.
!
Instruction Scope
Runtime instructions and scripts do more than passive notification: they (a) scan all agents' .learnings and certain SKILL.md files in the workspace, (b) write pending-notification JSON files, mark notified states, and delete pending files, (c) register a global hook and create per-agent cron jobs that trigger an agentTurn prompt which instructs an AI to perform semantic processing and then call other skills (skill-creator/skill-improvement) to create or edit skills. These operations modify other agents' workspaces and global config (openclaw.json) and enable automated creation/modification of code — powerful actions that expand scope beyond simple notification.
Install Mechanism
There is no formal install spec in the registry, but install.sh is the provided installer. install.sh calls openclaw skill install with URLs on https://clawhub.ai to fetch/install skill-creator and skill-improvement. That is a networked install of external code (moderate risk). The hook and scripts are copied into ~/.openclaw hooks/workspace which writes files to disk. The sources are not downloaded from obscure shorteners, but external package installs are performed automatically by the installer (or prompted) — review the remote targets before running.
Credentials
The skill declares no required env vars or secrets, and most file access is scoped to ~/.openclaw/workspace and ~/.openclaw/openclaw.json (used to discover agents, channels, and user IDs). However the installer and cron logic modify openclaw.json bindings and read channel account details; those are sensitive configuration operations (routing/IDs) and are necessary for the feature but should be noted as higher privilege than a normal per-skill workspace-only change.
!
Persistence & Privilege
The skill installs a global hook (copies handler.js to ~/.openclaw/hooks), injects references into agents' AGENTS.md and memory.md, and creates per-agent cron jobs via setup_crons.py (gateway API). These actions give it persistent presence and the ability to run periodically and trigger agentTurn prompts that can autonomously create/modify skills and agent workspaces. Although 'always' is not set, the skill gains persistent system presence and configuration-modifying privileges (hooks, crons, openclaw.json).
What to consider before installing
This skill is coherent with its description but exercises broad privileges: it will copy a global hook into ~/.openclaw/hooks, create per-agent cron jobs, modify ~/.openclaw/openclaw.json bindings, create/modify files in each agent's workspace (AGENTS.md, memory.md, .learnings), and may install additional skills from https://clawhub.ai. Before installing: - Review the full install.sh and the referenced scripts (you have them in the package). Pay attention to lines that call 'openclaw skill install' and that write to ~/.openclaw/openclaw.json or to other agents' directories. - Backup ~/.openclaw/openclaw.json and your ~/.openclaw/workspace in case you need to revert bindings or files. - Verify the external targets (clawhub.ai owner/repo slugs) that will be installed and inspect the code for skill-creator and skill-improvement, since they will be fetched and executed. - If you do not want autonomous modification of skills/workspaces, do not run the installer as-is. You can manually install components and avoid enabling the cron or skip the auto-injection steps (install.sh reports it can skip some actions). Consider running install.sh in a test environment first. - Consider restricting network access while installing, or run the install in a disposable container/VM to observe behavior. If you want to proceed, ensure you explicitly consent to the installer actions (especially binding updates and cron creation) and set CHANNEL/CHANNEL_ACCOUNT as prompted so notifications go to the expected account.

Like a lobster shell, security has layers — review code before you run it.

latestvk970jf7te5c5j8j8nt8kzn9yfh85gt5w
309downloads
0stars
44versions
Updated 2d ago
v4.6.13
MIT-0

self-improvement-loop v4.6.13

功能概述

核心能力:每个 agent 有独立的 self-improvement 闭环——隔离的 learnings 目录、独立的 cron 扫描、绑定到各自 channel bot 的通知、以及在正确 agent session 中执行 A/B/C/D。

用户纠正 code-dev agent
    ↓
code-dev hook 捕获 → 写入 code-dev/.learnings/
    ↓
self-improvement-code-dev cron(每1h)→ 只扫描 code-dev/.learnings/
    ↓
发现 pattern count≥2 → 通过 code bot 通知用户
    ↓
用户回复 A → code-dev agent session 执行 → 写回 code-dev workspace

数据流(Per-Agent 隔离)

openclaw.json (agents.list + bindings)
    │
    ├─→ install.sh 读取 agents
    │         ↓
    │    创建 per-agent 目录
    │    workspace/agents/code-dev/.learnings/
    │    workspace/agents/墨灵/.learnings/
    │
    ├─→ install.sh 读取 channel accounts
    │         ↓
    │    写入 bindings (agentId → accountId)
    │    { "agentId": "code-dev", "match": { "channel": "telegram", "accountId": "code" } }
    │
    └─→ setup_crons.py 创建 per-agent cron
              ↓
         每个 cron 带 --agent flag
         LEARNINGS_DIR 指向该 agent workspace
         delivery 使用该 agent 的 account

┌─────────────────────────────────────────────────────────────┐
│  Hook (handler.js) - 全局共享,动态路由                       │
│  sessionKey: "agent:code-dev:telegram:..."                 │
│  → extractAgentId("code-dev")                              │
│  → getAgentWorkspace("code-dev") → agent workspace path     │
│  → learningsDir = workspace + "/.learnings/"                │
│  推送提醒到 context.messages                                │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│  Cron (per-agent) - 各自独立运行                              │
│  Name: self-improvement-code-dev                            │
│  --agent code-dev → 绑定到 code-dev agent session           │
│  LEARNINGS_DIR=".../agents/code-dev/.learnings"              │
│  delivery: channel=telegram, accountId=code                │
│  只扫描自己的 LEARNINGS_DIR                                  │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│  Notification - 通过各自 channel bot 发送                    │
│  code bot → 用户与 code-dev 对话                             │
│  moling bot → 用户与 moling 对话                             │
│  用户回复 A/B/C/D → OpenClaw 根据 bindings 路由到正确 agent  │
└─────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────┐
│  A/B/C/D Execution - 在正确 agent session 中执行             │
│  读取 pending JSON → 执行 skill-creator/skill-improvement   │
│  写回到对应 agent 的 learnings 目录                          │
└─────────────────────────────────────────────────────────────┘

权限要求

权限作用域用途
execscripts/运行 distill.sh, archive.sh(机械扫描和归档)
readworkspace/<agent>/.learnings/读取 LEARNINGS.md, ERRORS.md, FEATURE_REQUESTS.md
writeworkspace/<agent>/.learnings/更新 notified 状态;创建 .pending_notifications/*.json
cron全局创建和管理 self-improvement-{agent} cron jobs
gateway_apiGateway :18789setup_crons.py 调用 API 创建 crons
openclaw.jsonHOME/.openclaw/install.sh 读取 agents 配置;写入 bindings

安全边界

  • 文件操作严格限定在 ~/.openclaw/workspace/ 下的 per-agent learnings 目录
  • 所有路径动态生成,无硬编码
  • cron 在 isolated session 中运行,最小工具集
  • install.sh 写入 bindings 前提示确认,可跳过

核心组件

组件类型路由依据
handler.js全局共享 HooksessionKey → agent ID → workspace
distill.sh共享脚本LEARNINGS_DIR 环境变量
setup_crons.py共享脚本agent config → cron --agent flag
install.sh安装脚本agents.list + accounts → bindings
agents-append.mdA/B/C/D 处理逻辑各 agent 共享;install.sh 注入索引引用

Per-Agent 配置矩阵

Agent        │ Workspace                      │ Channel Account │ Cron Job
─────────────┼───────────────────────────────┼───────────────────┼─────────────────────
main         │ workspace/.learnings           │ default           │ self-improvement-main
claude       │ workspace/.learnings           │ moling (fallback) │ self-improvement-claude
code-dev     │ workspace/agents/code-dev/.l. │ code              │ self-improvement-code-dev
moling       │ workspace/agents/墨灵/.l.     │ moling            │ self-improvement-moling

自动映射规则:
  - 精确匹配:agent_id == account_id
  - main → default
  - 前缀匹配:code-dev → code
  - 无匹配 → defaultAccount (moling)

安装

bash ~/.openclaw/workspace/skills/self-improvement-loop/install.sh
openclaw gateway restart

安装时自动:

  1. 创建各 agent 的 .learnings/ 目录
  2. 安装 hook 和脚本
  3. 创建 per-agent cron jobs
  4. 更新 openclaw.json bindings(实现消息路由)
  5. 各 agent workspaceAGENTS.mdmemory.md 注入自我改进索引指令

A/B/C/D 处理逻辑存放在 skills/self-improvement-loop/scripts/agents-append.md(各 agent 共享一份)。安装时向各 agent 的 AGENTS.mdmemory.md 注入索引指令:

## 自我改进(A/B/C/D)

处理 A/B/C/D 之前必须查阅:
skills/self-improvement-loop/scripts/agents-append.md

安装后无需手动追加内容,skill 更新时所有 agent 自动使用最新版本。


验证

# 检查 bindings
python3 -c "import json; print(json.dumps(json.load(open('$HOME/.openclaw/openclaw.json')).get('bindings',[]), indent=2))"

# 检查 per-agent crons
openclaw cron list | grep self-improvement

# 测试 distill(指定 agent)
LEARNINGS_DIR="$HOME/.openclaw/workspace/agents/code-dev/.learnings" \
  bash ~/.openclaw/workspace/skills/self-improvement-loop/scripts/distill.sh --check-only

依赖

依赖版本用途
OpenClaw≥2026.4平台基础
Python3≥3.8distill_json.py, write_notified.py
Node.js任意handler.js
skill-creatoranyA 路径创建技能
skill-improvementanyB 路径优化技能

限制与已知问题

  • ACP runtime agent (claude):无独立 channel,fallback 到 defaultAccount
  • API (Gateway):API 不通(404),回退到 CLI 创建 cron,sessionTarget 降级为 isolated
  • 并发通知:同一时刻多个 agent 触发时,用户回复可能路由到错误的 agent session
  • sessionTarget=current:需要 Gateway API 支持,当前不可用

See Also

  • references/setup-guide.md — 完整安装和配置指南

Comments

Loading comments...