Back to skill
Skillv1.0.0
ClawScan security
Openclaw Framework · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 5, 2026, 10:05 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only AI assistant framework that directs the agent to manage local memory files and periodic maintenance; it requests no credentials or installs and is consistent with its stated purpose.
- Guidance
- This skill is coherent with its description: it will direct the agent to create and maintain local memory files (memory/YYYY-MM-DD.md and a persistent MEMORY.md), perform periodic maintenance, and keep backups. Before installing, decide whether you are comfortable with the agent storing persistent notes on disk and running recurring tasks: (1) check where the memory/ directory will be created so it doesn't conflict with sensitive locations, (2) avoid putting secrets in those memory files, (3) ensure your agent execution model/host won't run the skill with elevated privileges, and (4) if you need to limit persistence, instruct the agent to disable or purge L3 memory. No credentials or external downloads are required by the skill itself.
Review Dimensions
- Purpose & Capability
- okThe name/description (an assistant framework) matches the SKILL.md content: guidance on memory layers, schedules, backup and self-improvement. There are no unrelated credential or binary requirements.
- Instruction Scope
- noteThe instructions tell the agent to create and maintain local files (memory/YYYY-MM-DD.md and MEMORY.md), run periodic 'heartbeat' maintenance (every 30 minutes), daily/weekly tasks, and automated backups. This is within scope for a framework but does require the agent to read/write persistent files and perform recurring actions; review whether you want such persistent local storage and automated behaviors.
- Install Mechanism
- okNo install spec or code is included; this is instruction-only so nothing is downloaded or written by an installer.
- Credentials
- okThe skill declares no environment variables, no credentials, and no config paths beyond the memory files it documents. The requested filesystem usage (memory/ and MEMORY.md) is proportional to an assistant framework that stores memories.
- Persistence & Privilege
- notealways is false and there is no explicit mechanism to enable persistent background processes in the package. However, the design expects recurring tasks (30-minute heartbeat, daily/weekly jobs). If the agent is allowed autonomous invocation or is run continuously, it can implement these periodic behaviors and write permanent MEMORY.md files—confirm that you want the agent to retain persistent data and run recurring tasks.