Personality Engine

This skill appears internally consistent and implements what it claims, but take these precautions before installing: - Review how you will actually send messages. The skill assumes you will call send_message/iMessage or another transport; ensure that transport (and any credentials it uses) is managed separately and not granted implicitly. - Be careful about prompt injection/leakage: the engine's context buffer and get_today_summary() are designed to be inserted into system prompts (the docs show doing this). If those prompts are sent to external LLM APIs (Claude, OpenAI, etc.), they may include private or sensitive user data. Audit what the buffer stores and consider scrubbing or redacting before including it in prompts. - Local persistence: state files (daily_context.json, response_tracker.json, micro_state.json, etc.) are written to ~/.openclaw/state/. If those files contain sensitive summaries you do not want on disk or available to other users/processes on the host, change the state_dir at construction time or secure the directory permissions. - Autonomous micro-initiations: by design the engine can generate unsolicited ambient messages (micro-initiations). If you do not want background pings, disable or tighten MICRO_CADENCE or ensure the agent only calls check_micro_initiations under explicit control. - Test in a sandbox: run the engine in a non-production environment, exercise integration points (send path, prompt injection) and inspect logs/state to confirm there are no hidden network calls in the truncated files you may not have reviewed. If you want, I can scan the remaining truncated source files for any network endpoints, subprocess execution, or other high‑risk patterns that would change this assessment.