K Deep Research

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill is mostly an instruction-only research workflow, but it should be reviewed because it directs agents to use broad local Obsidian/knowledge files without clear scoping and its embedded metadata conflicts with the registry summary.

Install only if you want an exhaustive research workflow. Before use, set clear rules for which local folders or Obsidian vaults the agent may read, keep secrets/private notes out of scope, and review the full referenced files and validation script if available. Use workspace-scoped installation first rather than making it shared across all agents.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Private notes or prior research could be pulled into the agent's context or generated reports without the user realizing how much local material was consulted.

Why it was flagged

The skill instructs agents to use broad local knowledge sources as part of research, but the artifacts do not define allowed paths, exclusions, approval gates, retention, or limits on reuse of private notes.

Skill content
Filesystem (existing knowledge):
- Obsidian vault (4000+ files)
- Prior investigation notes, timelines, frameworks
Recommendation

Before enabling, define exactly which vault/folders may be read, exclude secrets and private journals, and require confirmation before local-note content is included in outputs or follow-up research.

What this means

Users may not get an accurate registry-level view of when the skill is eligible or what local/network tooling it expects.

Why it was flagged

The embedded skill metadata declares a curl/wget dependency and alwaysActive=true, while the supplied registry metadata reports no required binaries and always=false, making activation and dependency expectations inconsistent.

Skill content
metadata: { "openclaw": { "emoji": "🔬", "requires": { "binsOneOf": ["curl", "wget"] }, "alwaysActive": true } }
Recommendation

Verify the installed package metadata directly, and prefer workspace-scoped installation until the dependency and activation settings are clarified.

What this means

If a user copies these examples into cron/heartbeat configuration, the agent could perform recurring research and send notifications without a per-run prompt.

Why it was flagged

The reference material includes examples for recurring autonomous monitoring, notifications, and memory maintenance. These appear to be documentation examples rather than automatically enabled behavior.

Skill content
"Research Monitoring Cron" ... "Check monitored topics in TASKS.md for new developments. If significant findings, write report to research/ and notify via telegram."
Recommendation

Treat the autonomy examples as optional templates only; add explicit schedules, budgets, notification rules, and human approval before enabling any recurring job.