Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Self-Evolving Agent (Lorin)
v1.0.0自我进化智能体 — 自动捕获错误+主动提炼经验+自动生成SKILL，三位一体持续进化。灵感来源：Hermes Agent skill_manage + pskoett self-improving-agent
⭐ 0· 47·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (self-improvement / skill extraction) match the shipped artifacts: hooks to inject reminders, an error detector script, and a skill-extraction script. The requested filesystem operations (creating .learnings and writing SKILL.md under skills/) and hook usage are expected for this feature.
Instruction Scope
SKILL.md and hook docs instruct the agent to capture errors, log learnings, and optionally promote them into skill files; hooks/scripts operate on local workspace files and suggest using platform session APIs (sessions_history/sessions_send). This is within scope, but the hooks/scripts will see command output and (if configured) may reference other session transcripts — enable only when you accept that local command output and session data may be inspected.
Install Mechanism
No remote downloads or package installs; the skill is instruction-plus-local-scripts. Scripts and handlers are provided in the bundle and create files under a relative skills/ or .learnings/ path. extract-skill.sh includes path validation to avoid writing outside the workspace.
Credentials
The skill declares no required credentials (good). Scripts expect a platform-provided environment variable CLAUDE_TOOL_OUTPUT for PostToolUse hooks; this env var is not listed in metadata but is a platform convention. The skill does not request unrelated secrets or cloud credentials.
Persistence & Privilege
The skill is not always-on and is user-invocable; hooks are opt-in and must be copied/enabled by the user. The hook code only injects a virtual reminder file and the scripts create files only when run. No modification of other skills or global agent internals is observed.
Assessment
This skill appears to do what it says: capture errors, prompt you to log learnings, and scaffold extracted skills. Before enabling it: (1) review the provided scripts (activator.sh, error-detector.sh, extract-skill.sh) to ensure you’re comfortable with local file writes; (2) be aware the error detector reads the platform variable CLAUDE_TOOL_OUTPUT (it examines command output) and hooks will see tool outputs and—if you use session APIs—may access other session transcripts; (3) enable the hooks only if you want those reminders and local file updates, and run extract-skill.sh from a directory you control (it prevents absolute/.. writes but will create files under the current workspace). If you need additional assurance, ask the maintainer for a signed provenance or run the scripts in a sandbox first.Like a lobster shell, security has layers — review code before you run it.
latestvk978ctqfv07n5g60trf875x7kn84mv00
License
MIT-0
Free to use, modify, and redistribute. No attribution required.