Nessie

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Referenced artifact was not completely inspected

Referenced artifact was not completely inspected

Referenced artifact was not completely inspected

Referenced artifact was not completely inspected

Referenced artifact was not completely inspected

Referenced artifact was not completely inspected

Referenced artifact was not completely inspected

Referenced artifact was not completely inspected

Referenced artifact was not completely inspected

The invocation scope is extremely broad, covering prior work, decisions, projects, notes, relationships, and anything previously discussed or researched. Because the skill also documents powerful read, write, and admin behaviors, broad triggering increases the chance of unnecessary access to sensitive personal/team data and expands the attack surface for prompt steering.

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

The skill is described as a search-and-read interface, but its instructions expose a very broad set of mutation and administrative capabilities including context edits, profile updates, sharing changes, skill management, and deletions. This violates least privilege and increases the chance that a host agent invokes sensitive operations under a benign-looking skill, leading to data loss, permission changes, or unintended persistence.

Embedding full skill-platform creation, editing, import, move, remove, and installation guidance inside a library-search skill creates unnecessary access to agent-behavior modification primitives. If followed by an agent, this could enable persistent changes to skills or bundles that affect future sessions and potentially all collaborators or subscribers.

Sharing-management operations are unrelated to the advertised read/search purpose and allow modification of who can access user data. Even with confirmation language, bundling these operations into a broadly-invoked reading skill raises the risk of accidental or socially engineered exposure of contexts, sources, skills, or sessions to other people or teams.

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Conversation deletion is a destructive capability that contradicts the skill's stated search-and-read purpose. Including deletion guidance in a commonly triggered retrieval skill makes accidental or manipulated data removal more plausible, especially because transcripts are synced source material and removal affects future availability.

The phrase about using Nessie for prior work is vague and does not define clear boundaries for non-activation. Ambiguity matters here because the skill is large and capable; an over-eager host might invoke it on many ordinary prompts, causing unnecessary retrieval from personal or shared memory sources.

Earlier sections instruct the agent to offer and perform write-back when durable knowledge emerges, including updating contexts and profiles. Later, the OpenClaw-specific policy says this host overrides that guidance and requires explicit confirmation before any mutation, creating a direct documentation-level contradiction about default behavior.