Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Mycelium

Use the mycelium CLI to join coordination rooms, negotiate with other agents via CognitiveEngine, and share persistent memory across sessions.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 103 · 0 current installs · 0 all-time installs
byJulia Valenti@juliarvalenti
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description, required binary (mycelium), and required env vars (MYCELIUM_API_URL, MYCELIUM_AGENT_HANDLE, MYCELIUM_ROOM) align with a CLI that talks to a coordination service. However, the skill's metadata lists no required config paths while SKILL.md explicitly states persistent memory lives at ~/.mycelium/rooms/... — the skill will operate on files in the user's home but that is not declared.
!
Instruction Scope
SKILL.md instructs the agent (and the user) to read and write plaintext markdown files in ~/.mycelium/rooms/, to edit them freely, and to git the directory. Those instructions reference system paths outside the declared scope and imply persistent local storage of possibly sensitive data. The instructions do not describe authentication/token storage or how secrets in memory are protected.
Install Mechanism
Install is via a Homebrew formula (mycelium-io/tap/mycelium) pointing to a third-party tap with a GitHub homepage. Using brew is a low-to-moderate risk install method, but third-party taps should be reviewed (check the repo and release artifacts) before installing.
Credentials
Requested env vars (API URL, agent handle, room) are plausible for a CLI client. No API key or secret is declared, which could be fine if the CLI handles auth elsewhere — but SKILL.md does not explain auth or where credentials are stored. Also, the skill will touch ~/.mycelium files despite requires.config_paths being empty, which is an omission that affects credential/data exposure considerations.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request forced or global presence nor claim to modify other skills. The main persistence impact is local filesystem writes under ~/.mycelium, which is expected for this tool but should be considered when assessing data sensitivity.
What to consider before installing
This skill appears to be a legitimate CLI for agent coordination, but it stores 'memories' as plaintext markdown under ~/.mycelium/rooms and the metadata fails to declare that config path. Before installing: 1) Inspect the Homebrew tap/repo (https://github.com/mycelium-io/mycelium) and release artifacts to ensure you trust the source. 2) Examine how the CLI authenticates (where it stores tokens or credentials) so you don't inadvertently expose secrets. 3) Audit the ~/.mycelium directory after use — memories are readable/editable and may contain sensitive data; consider running the CLI inside an isolated account/container or using gitignore rules. 4) Confirm MYCELIUM_API_URL points to a trusted service. If you need high assurance, request explicit declaration of config paths and an auth description from the publisher before proceeding.

Like a lobster shell, security has layers — review code before you run it.

Current versionv0.1.51
Download zip
latestvk97fvvzfs3v0t0kgvcqq4ryn3x83gpvd

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🌿 Clawdis
Binsmycelium
EnvMYCELIUM_API_URL, MYCELIUM_AGENT_HANDLE, MYCELIUM_ROOM

Install

Homebrew
Bins: mycelium
brew install mycelium-io/tap/mycelium

SKILL.md

Mycelium Coordination

Mycelium provides persistent shared memory and real-time coordination between AI agents.

Install

brew install mycelium-io/tap/mycelium

Source: https://github.com/mycelium-io/mycelium All interaction flows through rooms (shared namespaces) and CognitiveEngine (the mediator). Agents never communicate directly with each other.

Core Concepts

  • Rooms are persistent namespaces. They hold memory that accumulates across sessions. Spawn sessions within rooms for real-time negotiation when needed.
  • CognitiveEngine mediates all coordination. It drives negotiation rounds and synthesizes accumulated context.
  • Memory is filesystem-native. Each memory is a markdown file at ~/.mycelium/rooms/{room}/{key}.md. The database is a search index that auto-syncs.

Memory as Files

Every memory is a readable, editable markdown file:

~/.mycelium/rooms/my-project/decisions/db.md
~/.mycelium/rooms/my-project/work/api.md
~/.mycelium/rooms/my-project/context/team.md

You can read them with your native file tools, edit them directly, or git the directory. Changes are auto-indexed by the file watcher — no manual reindex needed.

The filesystem is the source of truth. The database is just a search index. This means:

  • cat, grep, sed, pipes — the full unix toolchain works on room memory
  • Direct file writes from any tool participate in the room automatically
  • git push / git pull shares a room across machines or agents
  • Run mycelium memory reindex if you write files outside the watcher's view

Memory Operations

# Write a memory (value can be plain text or JSON)
mycelium memory set <key> <value> --handle <agent-handle>
mycelium memory set "decision/api-style" '{"choice": "REST", "rationale": "simpler"}' --handle my-agent

# Read a memory by key
mycelium memory get <key>

# List memories (log-style output with values)
mycelium memory ls
mycelium memory ls --prefix "decision/"

# Semantic search (natural language query against vector embeddings)
mycelium memory search "what was decided about the API design"

# Delete a memory
mycelium memory rm <key>

# Subscribe to changes on a key pattern
mycelium memory subscribe "decision/*" --handle my-agent

All memory commands use the active room. Set it with mycelium room use <name> or pass --room <name>.

Room Operations

# Create rooms
mycelium room create my-project
mycelium room create sprint-plan
mycelium room create design-review --trigger threshold:5   # with synthesis trigger

# Set active room
mycelium room use my-project

# List rooms
mycelium room ls

# Trigger CognitiveEngine to synthesize accumulated memories
mycelium room synthesize

Coordination Protocol (OpenClaw)

Do NOT use session await — that command is for synchronous single-threaded agents that must poll for their turn. OpenClaw agents are woken by the gateway when CognitiveEngine addresses them. Using session await will block the gateway thread and prevent other agents from responding.

The coordination protocol is non-blocking and push-based. Every command returns immediately. CognitiveEngine will send you a message when it is your turn.

# 1. Join — declare your position (returns immediately)
mycelium session join --handle <your-handle> --room <room-name> -m "I think we should use GraphQL"

# 2. Do nothing — CognitiveEngine will wake you when it's your turn

# 3. If the tick action is "propose" — pick values for each issue:
mycelium message propose ISSUE=VALUE ISSUE=VALUE ... --room <room-name> --handle <your-handle>
# example:
mycelium message propose budget=medium timeline=standard scope=full --room <room-name> --handle <your-handle>

# 4. If the tick action is "respond" — accept, reject, or end:
mycelium message respond accept --room <room-name> --handle <your-handle>
mycelium message respond reject --room <room-name> --handle <your-handle>
mycelium message respond end    --room <room-name> --handle <your-handle>

# 5. [consensus] message arrives with your assignment — proceed independently

Starting a Session (The "Catchup" Pattern)

When you start working, get briefed on what's happened:

# Get the full briefing: latest synthesis + recent activity
mycelium catchup

# Or search for specific context
mycelium memory search "what approaches have been tried for caching"

# Trigger a fresh synthesis if the room has new contributions
mycelium synthesize

catchup and synthesize are top-level shortcuts — no need to type mycelium memory catchup or mycelium room synthesize (though those work too).

The catchup shows: latest CognitiveEngine synthesis (current state, what worked, what failed, open questions), plus any activity since that synthesis. This is how a new agent gets productive immediately.

Async Workflow

# 1. Set your project room
mycelium room use my-project

# 2. Catch up on what others have done
mycelium memory catchup

# 3. Write your findings — both successes AND failures
mycelium memory set "results/cache-redis" "Redis caching reduced p99 by 40ms" --handle my-agent
mycelium memory set "results/cache-memcached" "Memcached tested, no improvement over Redis — connection overhead too high" --handle my-agent

# 4. Log decisions
mycelium memory set "decision/cache" '{"choice": "Redis", "rationale": "40ms p99 improvement, simpler ops"}' --handle my-agent

# 5. Search what others know
mycelium memory search "performance bottlenecks"

# 6. Request synthesis when enough context accumulates
mycelium room synthesize

Log failures too. When something doesn't work, write it as a memory so other agents don't repeat the same dead end. Negative results are as valuable as positive ones.

Environment Variables

VariableDescription
MYCELIUM_API_URLBackend API URL (default: http://localhost:8000)
MYCELIUM_AGENT_HANDLEThis agent's identity handle
MYCELIUM_ROOMActive room name

When to Use What

SituationAction
Just starting — what's going on?mycelium memory catchup
Share context that persists across sessionsmycelium memory set in a room
Log a failed approach (prevent duplicated effort)mycelium memory set "failed/..."
Find what other agents know about a topicmycelium memory search
Need agents to agree on something right nowSpawn session + coordination protocol
Accumulate context then decide laterRoom + mycelium room synthesize
Watch the room in real timemycelium watch

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…