Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Session Digest
v4.1.3自动总结当天对话到 memory/YYYY-MM-DD.md。cron 23:00 自动运行，提取对话让 agent 自己总结。
⭐ 0· 54·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The script's behavior (reading agent session .jsonl files and producing a /tmp text file) matches the skill's stated purpose of extracting conversations for daily summaries. There are no unexpected external services or binaries required.
Instruction Scope
SKILL.md instructs running scripts/extract.js and having the agent read the produced /tmp file and summarize it — this is within scope. However the script reads all live agent sessions (main, claude, gemini, etc.) and will include any message content present in those session files; the provided simple sanitization (regex removals) may not remove all sensitive or system-level content. The skill also documents a cron trigger but provides no install steps to set that up.
Install Mechanism
No install spec is present (instruction-only plus a small script). Nothing is downloaded or written to system locations beyond the script writing a temporary output file; low install risk.
Credentials
Registry metadata declared no required config paths or credentials, yet the script reads from ~/.openclaw/agents (or OPENCLAW_DIR) — i.e., it accesses user-local agent session files. The skill does not request credentials, but it implicitly requires read access to that config/data path; this mismatch should have been declared. Also the output is written to /tmp which may be world-readable on some systems.
Persistence & Privilege
The skill is not always-enabled and does not modify other skills or system config. It only writes a temporary file and logs; no elevated persistence or privilege escalation is requested.
What to consider before installing
This skill appears to do what it says: it scans your local OpenClaw agent session files and writes a plain-text /tmp/session-digest-YYYY-MM-DD.txt for the agent to summarize. Before installing or enabling it, consider: 1) The script reads ~/.openclaw/agents/*/sessions/*.jsonl (it did not declare this config path in metadata) — confirm you are comfortable granting it read access to any session data stored there. 2) The temporary output is plaintext in /tmp and could contain sensitive system messages or secrets that the basic regex cleaning may not remove; inspect outputs before having the agent post them into memory. 3) If you want tighter scope, modify the script to limit which agents/sessions are scanned or add stronger redaction, and set up cron manually only after testing. 4) Because metadata omitted the config-path dependency, prefer to run the script manually once and review results before allowing automated or scheduled runs.Like a lobster shell, security has layers — review code before you run it.
latestvk97f459v3aesjhz6fw8v8dgvt183q5s0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.