Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Skill Experience Layer
v1.0.0Pre-call experience checking + error-driven learning + layered experience storage. Avoid repeating mistakes, get smarter every time. Pre-integrated with self...
⭐ 0· 138·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The described capability (keeping per-skill JSON experience files, reading them before calls, recording mistakes, and invoking an evolver) is coherent with the name and description. However the SKILL.md assumes integration with other skills (self-improving, capability-evolver) without declaring those dependencies or required permissions, which is an omission that reduces clarity.
Instruction Scope
The instructions tell the agent to create and update files (memory/experiences/{skill}.json and self-improving/corrections.md) and to 'promote key lessons to long-term memory in MEMORY.md' — yet the 'Safety Boundaries' claim the skill 'Never touches' core root files and 'reads but does not write' them. That is a direct contradiction. Also 'read before every invocation' and automatic triggering of capability-evolver could cause broad, repeated file reads/writes and autonomous changes without a clear, implementable approval mechanism.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so there is no installer or remote download risk.
Credentials
No environment variables, binaries, or credentials are requested (which matches a local file-based memory approach). That said, the skill implicitly requires filesystem write/read permission for memory/experiences/, self-improving/, and possibly MEMORY.md — these expected file accesses are not explicitly declared in requires.configPaths, and the policy/limits around which files may be modified are inconsistent in the doc.
Persistence & Privilege
always is false (good). Autonomous invocation is allowed (the platform default). The skill claims it will perform automatic evolution and backups and will trigger capability-evolver when mistakes repeat — this could grant the skill effective ongoing influence over agent behavior if the agent follows the instructions, so confirm human-approval steps and backup/rollback mechanisms before enabling automatic changes.
What to consider before installing
This skill's core idea is reasonable (store per-skill experience and consult it before calls), but there are contradictory and under-specified instructions you should clear up before installing. Ask the author to: (1) explicitly list which files the skill will read and which it will write (and add them to requires/configPaths), (2) resolve the contradiction about writing to MEMORY.md vs the 'never writes core root files' statement, (3) describe exactly how capability-evolver is triggered and require human approval for high-risk automatic changes, (4) show the backup/rollback implementation, and (5) confirm whether self-improving/corrections.md is considered a skill-owned file. Until those are clarified, run this skill in a sandboxed agent with limited filesystem permissions and do not grant it write access to global root files (MEMORY.md, IDENTITY.md, .env, etc.).Like a lobster shell, security has layers — review code before you run it.
latestvk974cn1yfw5hqjty7y4stsrr6x832ajc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🧠 Clawdis
OSLinux · macOS · Windows