CrabPet
ReviewAudited by ClawScan on May 10, 2026.
Overview
CrabPet appears to be a coherent local pet companion skill, but it works by reading your OpenClaw memory logs and saving derived pet stats/cards.
CrabPet looks safe for its stated purpose if you are comfortable with a local script analyzing your OpenClaw memory logs. Review pet cards before sharing because they can reveal usage patterns, personality inferences, streaks, and achievements. Some supplied file contents were truncated or omitted in the review context, so perform a full source review if you need stronger assurance.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your local OpenClaw memory logs can be processed into personality scores, activity stats, achievements, and pet cards. The artifacts do not show raw log exfiltration.
The engine locates a workspace memory directory and reads Markdown daily logs to compute XP and personality. This is disclosed and central to the pet feature, but those logs may contain private conversation history.
WORKSPACE_CANDIDATES = [Path.home() / ".openclaw" / "workspace", ... Path.home() / ".clawdbot" / "workspace", Path.home() / ".moltbot" / "workspace"] ... for f in sorted(MEMORY_DIR.glob("*.md")): ... content = f.read_text(encoding="utf-8", errors="ignore")Install only if you are comfortable with local memory-log analysis, and review generated pet cards before sharing them publicly.
Using the pet may execute the included Python engine and create or update local pet state and card files.
The skill instructs the agent to run included Python scripts for core pet functions. This is expected for the skill’s purpose and uses fixed commands, but it is still local code execution.
When the user interacts with their pet, use these scripts: ... python3 skills/crabpet/scripts/pet_engine.py status ... python3 skills/crabpet/scripts/pet_engine.py card
Allow these commands only for intended pet interactions, and keep the skill code from a trusted source.
It is harder to verify the project’s origin or compare the installed code against an official repository.
The registry information does not provide an upstream source or homepage for independent verification.
Source: unknown; Homepage: none
Prefer installing through the trusted ClawHub registry, and review the included files if provenance matters to you.