Knowledge Vault

This skill is broadly coherent with its stated purpose, but take these precautions before installing: - Review the SETUP-PROMPT.md before pasting or executing it. It contains shell commands (mkdir, install, chmod, cat). Only run them in a workspace you trust and have permission to modify. - Confirm your agent platform's memory/long-term-storage policy. The vault config enables syncing entries to the agent's memory_store; if you don't want persistent storage, disable memory_integration or adjust importance/retention settings. - Inspect scripts/vault-stats.sh locally before running. It requests jq and performs file reads; I noticed some malformed/odd code fragments in the script (likely a bug). Don't run scripts you haven't reviewed in an untrusted environment. - The skill will fetch external URLs when you ask it to ingest content (web_fetch/browser). Only ingest URLs you trust, and be comfortable with the agent making outbound fetches on your behalf. - If you plan to deploy the dashboard or API routes, secure them behind auth and don't expose the local data directory publicly. If you want higher assurance, ask the author for a reproducible install/test in a sandbox or request an updated release that fixes the script issues and documents platform/tool expectations.

These patterns were detected by automated regex scanning. They may be normal for skills that integrate with external APIs. Check the VirusTotal and OpenClaw results above for context-aware analysis.