🤖🤝🧠 better collab with your agent

ReviewAudited by ClawScan on May 1, 2026.

Overview

This skill appears purpose-aligned and local, but it handles very private ChatGPT history and can turn it into persistent agent guidance, so users should review outputs carefully.

Use this only with conversation exports you are comfortable analyzing locally. Before adding the generated profile to SOUL.md or AGENTS.md, check that it does not include sensitive details or misleading recommendations, and keep the output file protected.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI06: Memory and Context Poisoning

What this means

Your private conversation history may be summarized into a local file and into agent instructions that influence future interactions.

Why it was flagged

The documented workflow reads a complete ChatGPT export, writes a derived profile, and encourages using the result as persistent agent guidance.

Skill content

--input ~/Downloads/chatgpt-export/conversations.json ... --output ~/.openclaw/my-cognitive-profile.json ... Add to your `SOUL.md` or `AGENTS.md`

Recommendation

Review and redact the generated profile before saving it to SOUL.md or AGENTS.md, and store or delete the output file deliberately.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing dependencies could pull newer package versions than the author tested.

Why it was flagged

The dependency file uses broad lower-bound version ranges, so installing later versions depends on external package resolution rather than a pinned lockfile.

Skill content

scikit-learn>=1.3.0
numpy>=1.24.0
PyYAML>=6.0

Recommendation

Install in a virtual environment and consider pinning dependency versions if you need reproducible or higher-assurance use.