Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Outclaw Style

v1.0.6

Learn the user's writing style per outreach channel (email, LinkedIn, Twitter/X, WhatsApp, Slack, SMS, Discord, Telegram — whatever is connected for this ten...

0· 31·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for milstan/outclaw-style.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Outclaw Style" (milstan/outclaw-style) from ClawHub.
Skill page: https://clawhub.ai/milstan/outclaw-style
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install milstan/outclaw-style

ClawHub CLI

Package manager switcher

npx clawhub@latest install outclaw-style
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill legitimately needs access to outbound messages across many channels and to persist learned prompts locally, which matches its description. However, it references many external CLIs/services (gog gmail, linkedin-cli, slack-mcp-server, whatsapp-mcp-ts, telegram-mcp, discord-mcp, XActions/xurl, mac_messages_mcp, bsky-mcp-server) and local helper scripts (scripts/message_classifier.py, scripts/style_evaluator.py) that are not declared in the skill's metadata (no required binaries, no install instructions, no required env vars). That mismatch (needs many connectors but declares none) is concerning and can lead to silent failures or unexpected behavior if the platform does not supply those connectors.
!
Instruction Scope
Runtime instructions explicitly tell the agent to collect outbound messages, classify them, write raw message dumps to kb/raw/style-<tenant>-<channel>-<ts>.jsonl and persist learned prompts in ~/.openclaw/outclaw/styles/<tenant>/<channel>_style.md. The skill can be auto-invoked silently by outclaw-plan to process a channel with no learned style, meaning it may read and persist private messages without a direct user prompt. There is also an internal inconsistency: the references describe a 'User Confirmation' step presenting sample messages for approval, while the SKILL.md emphasizes silent auto-invocation and forbids soliciting 'preferred tone' — it's unclear when/if user confirmation happens.
Install Mechanism
This is an instruction-only skill with no install spec (lowest install risk). However, it depends on external CLIs and local scripts that are not included in the package. The absence of an install mechanism or bundled tooling means the skill will either fail when those commands are missing or rely on platform-provided connectors; that operational gap is important to verify before use.
!
Credentials
The skill requests no environment variables or explicit credentials in metadata, yet its operation requires access to message stores and connectors that typically need OAuth tokens/credentials. It also accesses local config/memory files (capabilities/<tenant>.json, tenant memory, kb, and home directory paths). The lack of declared credential requirements reduces transparency about what secrets will be used or required by the platform for it to function.
Persistence & Privilege
always:false (good). The skill will persist data to the user's home (~/.openclaw/outclaw/styles/) and to kb/raw/ (raw message exports). Persisting training data and learned prompts is consistent with the skill's purpose, but combined with auto-invocation (silent, one-channel runs triggered by outclaw-plan) this creates a privacy surface: private outbound messages will be written to disk without an explicit permission prompt unless the platform enforces such prompts. The skill does not attempt to modify other skills or system settings.
What to consider before installing
Key things to check before installing or enabling this skill: - Confirm connectors and prerequisites: Ask the platform/author which connectors (gog gmail, slack-mcp-server, whatsapp-mcp-ts, linkedin-cli, etc.) and local scripts (scripts/message_classifier.py, scripts/style_evaluator.py) must be present and whether the platform will provide them. The skill references these but declares none, so it may fail or behave unexpectedly. - Clarify credential handling: The skill will need access to your message stores (email, Slack, WhatsApp, Telegram, Discord, etc.). Find out where OAuth tokens/credentials are stored, whether the platform will prompt you, and whether the skill will request any new credentials. Do not assume 'no env vars' means no secrets are used — connectors often require them. - Understand auto-invocation/privacy: The skill can be auto-invoked silently by outclaw-plan to process a channel and will read outbound messages and write raw exports to kb/raw/ and learned prompts to ~/.openclaw/outclaw/styles/. If you do not want automatic scanning of message history, disable auto-invoke or require user confirmation for runs. - Inspect persistence and storage protections: Raw outbound messages will be saved to disk. Ask where kb/raw/ and ~/.openclaw/ are located on your environment, who can read them, and whether they are encrypted. If sensitive, request that raw exports be avoided or that the skill redact PII before persisting. - Resolve inconsistencies around user confirmation: The references include a 'User Confirmation' step (showing sample messages for approval) but SKILL.md also describes silent auto-invocation and forbids prompting for 'preferred tone'. Ask the author to clarify when the skill will present samples for review and when it will run silently. - Request missing artifacts or run in a sandbox: The skill refers to scripts that are not bundled. Ask the author for those scripts or run the skill in a test/sandbox environment first to observe behavior and logs. - If you proceed, prefer explicit opt-in: Only enable the skill for tenants/channels you explicitly permit, and consider disabling automatic background runs until you are satisfied with its data handling and required connectors.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎨 Clawdis
latestvk977k0v9cs2vj03ee6xp9z1ry585eyyb
31downloads
0stars
7versions
Updated 1h ago
v1.0.6
MIT-0

OutClaw — Style

Learns a per-channel style prompt for the current tenant and persists it at ~/.openclaw/outclaw/styles/<tenant>/<channel>_style.md. Each style prompt is what outclaw-plan uses to draft messages on that channel.

Resolver mandate

Before writing styles, memory entries, or any KB update, read shared/references/RESOLVER.md. Styles go in styles/<tenant>/<channel>_style.md. NEVER hand-craft a different path. A trained-style summary goes to tenant memory as type=user, key=style_trained_<channel> so outclaw-plan can find it quickly without re-reading the style file.

When this skill runs

  1. Explicit user requestlearn my style, retrain style for email.
  2. Auto-invoked, silent — when outclaw-plan builds a plan that includes a channel with no learned style for this tenant, it invokes this skill for that one channel, waits for completion, then continues. No user prompt. No interruption.

Prompt Learning Protocol (implements the user's gist)

The gist at https://gist.github.com/milstan/3b12f938f344f4ae1f511dd19e56adce prescribes:

  1. Sample collection — gather ≥20 outbound messages per channel (or ≥1 000 words / ≥10 pairs, whichever floor is higher). If fewer are available, work with what you find; mark confidence accordingly. Do not fabricate samples.
  2. Analysis — a thinking model identifies dimensions of quality, structural/stylistic patterns, anti-patterns the samples avoid.
  3. Candidate prompt — direct, actionable instructions ("Write sentences that average 12-18 words"), target 500-2 000 words, with an explicit Avoid section.
  4. Iteration loop (5 cycles default) per channel:
    • Generate test output with moderate temperature (0.6-0.8)
    • Evaluate against dimensions (0-100 LLM judgments)
    • Track best-of-N
    • Refine (lower temperature 0.2-0.4, focus on lowest-scoring dimensions)
  5. Output: learned prompt + best score + iteration number + dimensions
    • conformity log. Save to ~/.openclaw/outclaw/styles/<tenant>/<channel>_style.md with YAML frontmatter (tenant, channel, trained_at, sample_count, best_score, best_iteration, dimensions).

See references/style-learning.md for the detailed steps and agents/style-learner.md for the delegated sub-agent spec.

Per-channel sources (which tools to use)

For each channel we care about, list where outbound samples can be read from. The agent picks only channels this tenant has ready in the capability map (capabilities/<tenant>.json).

ChannelSample source
Gmailgog gmail messages search "from:me" --max 50
LinkedInlinkedin-cli posts --author me --max 50 (if connected) or export
Twitter/XXActions or direct API via xurl
Slackslack-mcp-server message history where sender=me
WhatsAppwhatsapp-mcp-ts conversation export, filter author=me
Telegramtelegram-mcp sent messages
Discorddiscord-mcp messages where author=me
iMessage/SMSmac_messages_mcp sent messages
Blueskybsky-mcp-server user posts

Flow

  1. Pick channels — from memory tool_inventory, enumerate channels that have a ready plugin AND a sample source. Skip channels with no connected plugin entirely (no point training).

  2. For each selected channel, run a sub-task: a. Pull outbound samples via the channel's plugin. Write raw samples to kb/raw/style-<tenant>-<channel>-<ts>.jsonl (NOT into the KB's people/orgs — this is training data, filed under raw/). b. If the sample count is <20 or <1 000 words, log a memory observation and proceed anyway: {type: observation, key: "style_thin_<channel>", insight: "only <N> samples — learned prompt confidence will be lower", source: "observed", confidence: 6}. c. Two-stage classify: heuristic pre-filter (outbound, non-trivial length, not auto-reply) → LLM OUTREACH_COLD/FOLLOWUP/WARM vs. NOT_OUTREACH (see scripts/message_classifier.py). d. Run the 5-iteration Prompt Learning Protocol (scripts/style_evaluator.py). e. Write the learned style to ~/.openclaw/outclaw/styles/<tenant>/<channel>_style.md. f. Log: {type: user, key: "style_trained_<channel>", insight: "<channel> style trained; score <N>/100; <K> samples", source: "observed", confidence: <N/10>}.

  3. If auto-invoked (from outclaw-plan): do ONE channel (the one requested), silent, then return to the caller. NEVER ask the user for "preferred tone" or "desired format" — the whole point of this skill is that we infer style from samples. If a channel has no outbound samples at all (e.g. user just connected Discord today), log an observation: {type: observation, key: "style_nosamples_<channel>", insight: "no outbound samples on <channel>; using neutral template", source: "observed", confidence: 6} and emit a minimal neutral template at styles/<tenant>/<channel>_style.md with sample_count: 0, best_score: null, and a generic "direct, concise, warm-professional" prompt. Return to caller.

  4. If user-invoked: show a compact report — which channels were trained, best score each, sample count, confidence.

Filing rules (RESOLVER-compliant)

  • Style prompt: styles/<tenant>/<channel>_style.md — NEVER kb/styles/*, NEVER kb/me/styles/*.
  • Raw outbound samples (the training data): kb/raw/style-<tenant>-<channel>-<ts>.jsonl.
  • Summary for fast lookup: tenant memory, type=user, key=style_trained_<channel>.
  • Do NOT put learned styles in kb/me/self.md — voice description there is for context, the style prompt lives separately.

Consent

Sample collection is a one-time opt-in, captured during outclaw-setup Step 2 as a memory preference entry. If no consent entry exists when this skill runs:

  • Explicit invocation: ask once, record the decision.
  • Auto-invocation from plan: proceed only if the tenant has an opt-in style_consent entry. If missing, log an observation and fall back to a neutral template style. Never silently scrape without consent.

Output format (style prompt file)

---
tenant: outclaw
channel: gmail
trained_at: 2026-04-22T12:00:00Z
sample_count: 42
best_score: 82
best_iteration: 3
dimensions: [sentence_length, formality, personalization, cta_style, structure, tone, greeting_pattern, signoff_pattern]
conformity_log:
  - {iter: 1, score: 64}
  - {iter: 2, score: 71}
  - {iter: 3, score: 82}
  - {iter: 4, score: 80}
  - {iter: 5, score: 78}
---

# Gmail style — outclaw (tenant)

## Instructions
<the learned prompt — 500-2000 words, direct + actionable>

## Avoid
- <anti-pattern 1>
- <anti-pattern 2>

## Reference samples
- <path>/raw/style-outclaw-gmail-<ts>.jsonl (not included verbatim here;
  pointer only)

This format lets outclaw-plan parse the "Instructions" section directly into the draft-generation prompt.

Comments

Loading comments...